Application risk identification method, device and equipment and computer readable storage medium

Abstract

The invention discloses an application risk identification method, which comprises the following steps: determining a to-be-identified application, and obtaining a log file of the to-be-identified application; performing information extraction on the log file to obtain a to-be-analyzed SQL statement corresponding to the to-be-identified application; for each to-be-analyzed SQL statement, obtaining an execution interpretation plan of the to-be-analyzed SQL statement in a database of the to-be-identified application; and analyzing the execution interpretation plans by using a preset risk rule base, and determining whether the to-be-identified application is a risk application or not. By applying the technical scheme provided by the invention, more accurate and efficient application risk identification can be realized, so that application performance risks can be prevented in time, and application information security is ensured. The invention further provides an application risk identification device, electronic equipment and a computer readable storage medium which all have the above technical effects.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to an application risk identification method, and also to an application risk identification device, an electronic device, and a computer-readable storage medium. Background Art

[0002] As enterprise informatization continues to deepen, database performance optimization has become particularly important as a core component for information storage and processing. SQL (Structured Query Language) statements are the main way to operate a database, and their performance directly affects the overall performance of the database. Currently, there is a lack of tools on the market that automatically analyze and identify risks for business SQL statements developed in development projects, which makes it impossible to automatically and effectively identify risks, and there is a problem of SQL statements with performance risks leaking into the production environment.

[0003] At present, in the software development process, the usual practice is that the DBA (Database Administrator) analyzes the slow SQL in the database and feeds the identified slow SQL back to the developer, who then optimizes the performance. Obviously, this implementation method requires high skills of the relevant personnel. And only one SQL statement can be analyzed at a time, which is inefficient. In addition, the general database slow SQL analysis is performed after the fact, which cannot prevent the occurrence of performance risks.

[0004] Therefore, how to achieve more accurate and efficient application risk identification in order to prevent application performance risks in a timely manner and ensure application information security is an urgent problem to be solved by technical personnel in this field. Summary of the invention

[0005] The purpose of this application is to provide an application risk identification method, which can achieve more accurate and efficient application risk identification, so as to timely prevent application performance risks and ensure application information security; another purpose of this application is to provide an application risk identification device, electronic device and computer-readable storage medium, all of which have the above-mentioned beneficial effects.

[0006] In a first aspect, the present application discloses an application risk identification method, comprising:

[0007] Determine an application to be identified, and obtain a log file of the application to be identified;

[0008] Extracting information from the log file to obtain the SQL statement to be analyzed corresponding to the application to be identified;

[0009] For each SQL statement to be analyzed, obtaining an execution explanation plan of the SQL statement to be analyzed in a database of the application to be identified;

[0010] Each of the execution explanation plans is analyzed using a preset risk rule library to determine whether the application to be identified is a risk application.

[0011] Optionally, extracting information from the log file to obtain a SQL statement to be analyzed corresponding to the application to be identified includes:

[0012] Extracting information from the log file to obtain all SQL statements corresponding to the application to be identified;

[0013] For each SQL statement, performing functional analysis on the SQL statement to determine the statement function of the SQL statement;

[0014] All SQL statements are deduplicated according to the statement functions of the SQL statements to obtain the SQL statements to be analyzed.

[0015] Optionally, extracting information from the log file to obtain a SQL statement to be analyzed corresponding to the application to be identified includes:

[0016] Extracting information from the log file to obtain all SQL statements corresponding to the application to be identified;

[0017] For each SQL statement, calculating the similarity between the abstract syntax tree structure of the SQL statement and the abstract syntax tree structures of other SQL statements;

[0018] All SQL statements are deduplicated according to the similarities to obtain the SQL statements to be analyzed.

[0019] Optionally, after extracting information from the log file to obtain the SQL statement to be analyzed corresponding to the application to be identified, the method further includes:

[0020] For each SQL statement to be analyzed, the SQL statement to be analyzed is identified using a preset whitelist to determine whether the SQL statement to be analyzed is a risk-free SQL statement;

[0021] The risk-free SQL statements are eliminated from all the SQL statements to be analyzed.

[0022] Optionally, the preset risk rule base includes a multi-level risk rule base, and the using of the preset risk rule base to analyze each of the execution explanation plans to determine whether the application to be identified is a risk application includes:

[0023] For each execution explanation plan, the execution explanation plan is matched with each level of risk rule base to determine whether the execution explanation plan hits each level of risk rule base;

[0024] When all the execution explanation plans do not hit any level of risk rule base, determining that the application to be identified is not the risk application;

[0025] When any of the execution explanation plans hits any level of risk rule base, the application to be identified is determined to be the risk application.

[0026] Optionally, the application risk identification method further includes:

[0027] When it is determined that the application to be identified is the risk application, generating and saving a risk log corresponding to the risk application;

[0028] Among them, the risk log includes application information of the risk application, SQL statements corresponding to the execution explanation plan that hits the multi-level risk rule library, the execution explanation plan that hits the multi-level risk rule library, the hit rules of the execution explanation plan and one or more combinations of risk levels.

[0029] Optionally, the determining the application to be identified and obtaining the log file of the application to be identified includes:

[0030] Determine the application to be identified, and start the scheduled task corresponding to the application to be identified;

[0031] Obtain the log file of the application to be identified according to the scheduled task.

[0032] In a second aspect, the present application also discloses an application risk identification device, comprising:

[0033] A determination module, used to determine the application to be identified and obtain the log file of the application to be identified;

[0034] An extraction module, used to extract information from the log file to obtain the SQL statement to be analyzed corresponding to the application to be identified;

[0035] An acquisition module, configured to acquire, for each SQL statement to be analyzed, an execution explanation plan of the SQL statement to be analyzed in a database of the application to be identified;

[0036] The analysis module is used to analyze each of the execution explanation plans using a preset risk rule library to determine whether the application to be identified is a risk application.

[0037] In a third aspect, the present application further discloses an electronic device, comprising:

[0038] Memory for storing computer programs;

[0039] A processor is used to implement the steps of any one of the application risk identification methods described above when executing the computer program.

[0040] In a fourth aspect, the present application further discloses a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of any one of the application risk identification methods described above are implemented.

[0041] The present application provides an application risk identification method, comprising: determining an application to be identified and obtaining a log file of the application to be identified; extracting information from the log file to obtain a SQL statement to be analyzed corresponding to the application to be identified; for each SQL statement to be analyzed, obtaining an execution explanation plan of the SQL statement to be analyzed in a database of the application to be identified; and analyzing each of the execution explanation plans using a preset risk rule library to determine whether the application to be identified is a risky application.

[0042] By applying the technical solution provided in the present application, for the application to be identified, the corresponding SQL statement to be analyzed is first extracted from its corresponding log file, and then the database of the application to be identified is associated to obtain the execution interpretation plan of each SQL statement to be analyzed, and then the risk analysis of each execution interpretation plan is implemented using the preset risk rule library, thereby realizing the risk identification of the application to be identified, that is, realizing automated application risk identification, with better accuracy and efficiency, and this technical solution does not affect the normal operation of the application, can effectively and timely prevent application performance risks, and further ensure the security of application information.

[0043] An application risk identification device, electronic device and computer-readable storage medium provided in this application also have the above-mentioned technical effects, which will not be elaborated in this application. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions in the prior art and the embodiments of the present application, the drawings required for use in the description of the prior art and the embodiments of the present application are briefly introduced below. Of course, the drawings described below in relation to the embodiments of the present application are only part of the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without creative work, and the obtained other drawings also belong to the protection scope of the present application.

[0045] Figure 1 A flowchart of an application risk identification method provided in this application;

[0046] Figure 2A flowchart of another application risk identification method provided for this application;

[0047] Figure 3 A schematic diagram of the structure of an application risk identification device provided in this application;

[0048] Figure 4 A schematic diagram of the structure of an electronic device provided in this application. DETAILED DESCRIPTION

[0049] The core of this application is to provide an application risk identification method, which can achieve more accurate and efficient application risk identification, so as to timely prevent application performance risks and ensure application information security; another core of this application is to provide an application risk identification device, electronic device and computer-readable storage medium, all of which have the above-mentioned beneficial effects.

[0050] In order to describe the technical solutions in the embodiments of the present application more clearly and completely, the technical solutions in the embodiments of the present application will be introduced below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0051] An embodiment of the present application provides a method for identifying application risks.

[0052] Please refer to Figure 1 , Figure 1 This is a flow chart of an application risk identification method provided in the present application. The application risk identification method may include the following S101 to S104.

[0053] S101: Determine an application to be identified, and obtain a log file of the application to be identified.

[0054] This step aims to determine the application to be identified and obtain its log file, wherein the application to be identified is the application that needs to be identified for application risk, and the log file is the log file generated by the application to be identified during the actual operation, which contains various types of log information generated by the application to be identified during the operation. Specifically, the user can specify the application to be identified in the system through the user terminal to start the risk identification operation for the application to be identified, and first obtain the log file of the application to be identified during the risk identification operation, so as to realize the risk identification of the application to be identified. Here, risk identification of the application to be identified is to determine whether the application to be identified is a risky application, that is, to determine whether the application to be identified has risks.

[0055] In one embodiment of the present application, the above-mentioned determining the application to be identified and obtaining the log file of the application to be identified may include:

[0056] Determine the application to be identified and start the scheduled task corresponding to the application to be identified;

[0057] Obtain the log files of the application to be identified according to the scheduled task.

[0058] The embodiment of the present application provides a method for obtaining the log file of the application to be identified. Specifically, after determining the application to be identified, its corresponding scheduled task can be started, and the scheduled task can obtain the log file of the application to be identified at a preset time interval to implement application risk identification based on the preset time interval. It should be noted that the specific value of the above-mentioned preset time interval does not affect the implementation of the present technical solution, and can be set by technical personnel according to actual needs, and the present application does not limit this.

[0059] S102: Extract information from the log file to obtain the SQL statement to be analyzed corresponding to the application to be identified.

[0060] This step aims to extract the SQL statements to be analyzed from the log file. It is understandable that SQL statements are the main way of database operation, and their performance directly affects the overall performance of the database. Therefore, the SQL statements to be analyzed can be extracted from the log file, and application risk identification can be achieved by analyzing and identifying the SQL statements to be analyzed. Here, the extraction of the SQL statements to be analyzed can be achieved using relevant statement extraction tools, and this application will not go into details here.

[0061] In one embodiment of the present application, extracting information from the log file to obtain the SQL statement to be analyzed corresponding to the application to be identified may include:

[0062] Extract information from the log file to obtain all SQL statements corresponding to the application to be identified;

[0063] For each SQL statement, perform functional analysis on the SQL statement to determine the statement function of the SQL statement;

[0064] All SQL statements are deduplicated according to the statement functions of each SQL statement to obtain the SQL statement to be analyzed.

[0065] The embodiment of the present application provides a method for extracting SQL statements to be analyzed in a log file. First, all SQL statements corresponding to the application to be identified are extracted from the entire log file, and then each SQL statement is functionally analyzed to determine the function it implements, that is, to determine the statement function of each SQL statement, thereby, SQL statement deduplication processing can be implemented with reference to the statement function of each SQL statement, that is, only one SQL statement with the same statement function is retained, and thus, all SQL statements after deduplication processing are SQL statements to be analyzed.

[0066] In one embodiment of the present application, extracting information from the log file to obtain the SQL statement to be analyzed corresponding to the application to be identified may include:

[0067] Extract information from the log file to obtain all SQL statements corresponding to the application to be identified;

[0068] For each SQL statement, calculate the similarity between the abstract syntax tree (AST) structure of the SQL statement and the abstract syntax tree structures of other SQL statements;

[0069] All SQL statements are deduplicated according to the similarities to obtain the SQL statements to be analyzed.

[0070] The embodiment of the present application provides another implementation method for extracting SQL statements to be analyzed in a log file. First, all SQL statements corresponding to the application to be identified are extracted from the entire log file, and then the abstract syntax tree of each SQL statement is determined, and the similarity between any two abstract syntax trees is calculated, so that only one of the two SQL statements corresponding to the two abstract syntax trees with higher similarity is retained to achieve deduplication of SQL statements.

[0071] It is understandable that by deduplicating SQL statements, unnecessary repeated analysis workload can be effectively reduced, which helps to further improve the efficiency of application risk identification.

[0072] In one embodiment of the present application, after extracting information from the log file to obtain the SQL statement to be analyzed corresponding to the application to be identified, the following may also be included:

[0073] For each SQL statement to be analyzed, a preset whitelist is used to identify the SQL statement to be analyzed to determine whether the SQL statement to be analyzed is a risk-free SQL statement;

[0074] Eliminate risk-free SQL statements from all SQL statements to be analyzed.

[0075] The application risk identification method provided in the embodiment of the present application can further implement the screening and processing of SQL statements. In the implementation process, a SQL statement whitelist can be created in advance, that is, the above-mentioned preset whitelist, in which the SQL statements contained are all legal SQL statements, that is, SQL statements without any network risks, that is, the above-mentioned risk-free SQL statements. On this basis, each SQL statement to be analyzed is matched with each SQL statement in the preset whitelist. If the SQL statement to be analyzed hits the preset whitelist, it means that the SQL statement to be analyzed is a legal SQL statement, and there is no need to continue the subsequent analysis. It can be directly removed to continue to identify the next SQL statement to be identified; if the SQL statement to be analyzed does not hit the preset whitelist, it cannot be determined whether the statement to be analyzed is a legal SQL statement, and it is necessary to continue to perform subsequent analysis on it.

[0076] It is understandable that by screening SQL statements to remove risk-free SQL statements, the workload of analysis can be effectively reduced, which helps to further improve the efficiency of application risk identification. In addition, for SQL statements that do not hit the preset whitelist, when the SQL statement is subsequently identified as a risk-free SQL statement, it can also be added to the preset whitelist to implement the update of the preset whitelist.

[0077] S103: For each SQL statement to be analyzed, an execution explanation plan of the SQL statement to be analyzed is obtained in a database of the application to be identified.

[0078] This step aims to achieve the acquisition of the execution explanation plan of each SQL statement to be analyzed. Specifically, the database of the current application to be identified can be connected to obtain the execution explanation plan of each SQL statement to be analyzed. Among them, the execution explanation plan of the database means that when the database server executes an SQL statement, there will be multiple sets of execution plans corresponding to it, and finally the execution plan with the least resource consumption will be selected. This execution plan is the execution explanation plan, that is, the plan in which the SQL statement is finally physically executed. Therefore, the execution explanation plan of the SQL statement contains more relevant information of the SQL statement, which helps to achieve more accurate application risk identification.

[0079] S104: Analyze each execution explanation plan using a preset risk rule library to determine whether the application to be identified is a risky application.

[0080] This step aims to achieve application risk identification based on the preset risk rule library. Specifically, for each execution explanation plan, the preset risk rule library can be used to analyze and identify it to determine whether the SQL statement corresponding to the execution explanation plan is a risk-free SQL statement, and then determine whether the application to be identified is a risky application. It can be understood that if the execution explanation plan hits the preset risk rule library, it means that the SQL statement corresponding to the execution explanation plan is a risky SQL statement, otherwise it is considered to be a risk-free SQL statement. Furthermore, when all SQL statements are risk-free SQL statements, the application to be identified can be determined to be a risk-free application; when any SQL statement is a risky SQL statement, the application to be identified can be determined to be a risky application. At this point, risk identification for the application to be identified is achieved.

[0081] In one embodiment of the present application, the preset risk rule library may include a multi-level risk rule library. The above-mentioned use of the preset risk rule library to analyze each execution explanation plan to determine whether the application to be identified is a risk application may include:

[0082] For each execution explanation plan, the execution explanation plan is matched with each level of risk rule base to determine whether the execution explanation plan hits each level of risk rule base;

[0083] When all execution explanation plans do not hit any level of risk rule base, it is determined that the application to be identified is not a risk application;

[0084] When any execution explanation plan hits any level of risk rule base, the application to be identified is determined to be a risk application.

[0085] The embodiment of the present application provides a method for implementing risk identification of the application to be identified through a preset risk rule base. Specifically, the preset risk rule base can include multiple levels of risk rule bases, such as a high-level risk rule base, an intermediate risk rule base, and a low-level risk rule base, and different levels of risk rule bases contain different risk types; then, each execution explanation plan is matched and analyzed with the risk rule bases at all levels to determine whether the SQL statements corresponding to each execution explanation plan are risky SQL statements, and at the same time determine the risk level of the risky SQL statements, and finally implement risk identification of the application to be identified based on the identification results of all SQL statements.

[0086] It can be seen that the application risk identification method provided in the embodiment of the present application, for the application to be identified, first extracts the corresponding SQL statement to be analyzed from its corresponding log file, and then associates the database of the application to be identified to obtain the execution interpretation plan of each SQL statement to be analyzed, and then uses the preset risk rule library to implement the risk analysis of each execution interpretation plan, thereby realizing the risk identification of the application to be identified, that is, realizing automated application risk identification, with better accuracy and efficiency, and this technical solution does not affect the normal operation of the application, can effectively and timely prevent application performance risks, and further ensure the security of application information.

[0087] Based on the above embodiments:

[0088] In one embodiment of the present application, the application risk identification method may further include:

[0089] When the application to be identified is determined to be a risky application, a risk log corresponding to the risky application is generated and saved;

[0090] Among them, the risk log includes application information of risk applications, SQL statements corresponding to execution explanation plans that hit multi-level risk rule bases, execution explanation plans that hit multi-level risk rule bases, hit rules of execution explanation plans, and one or more combinations of risk levels.

[0091] The application risk identification method provided in the embodiment of the present application can further realize the generation and preservation of risk logs. Here, the risk log refers to the risk-related log of the application determined to be at risk, which may include but is not limited to the application information of the risk application, the SQL statement corresponding to the execution explanation plan that hits the multi-level risk rule library, the execution explanation plan that hits the multi-level risk rule library, the hit rules and risk level of the execution explanation plan, etc. In addition, for the risk application that is finally determined, the corresponding alarm prompt can be further output to remind the technical staff to carry out operation and maintenance in time.

[0092] Based on the above embodiments, the embodiment of the present application provides another application risk identification method.

[0093] Please refer to Figure 2 , Figure 2 This is a flow chart of another application risk identification method provided by the present application. The application risk identification method can be applied to an application risk identification device, and its implementation process may include the following steps:

[0094] 1. Start the analysis task regularly and synchronize the log files of the application to be analyzed to this device.

[0095] 2. Scanning log files: This device scans the log files of the application to be analyzed, and extracts all SQL statements in the log files by scanning. It can be understood that in the log file, the SQL statements of all test operations are recorded, including similar statements with the same functional output. In order to ensure work efficiency, in the actual application scenario, only one output statement containing the same function can be checked, so the SQL statements can be deduplicated. Here, in order to achieve the deduplication function, the abstract syntax tree (AST) can be used as an efficient technology for statement comparison and matching. The specific method is to convert the SQL statement into an AST format that is easy to compare, and then compare the similarities and differences between different SQL statements in the AST structure to determine the duplicate data entries that need to be removed. It can be imagined that the use of a comparison method based on the AST structure can not only significantly improve processing efficiency and reduce the risk of misjudgment, but also lay a solid foundation for subsequent precise deduplication operations, ensuring the accuracy of software functions and the stable operation of the system.

[0096] 3. Generate SQL sets to be analyzed: The extracted SQL statements are filtered through a whitelist to generate a SQL set to be analyzed. The whitelist contains SQL statements that have been manually identified and confirmed to be risk-free. After filtering through the whitelist, the set of SQLs to be processed can be effectively reduced to further improve analysis efficiency.

[0097] 4. Get the execution plan and analyze it: This device will connect to the database corresponding to the application to be identified, and get the execution explanation plan of the SQL to be analyzed from the database. Then, based on the returned execution explanation plan, the device can accurately identify high-risk issues, such as scanning all sub-libraries and sub-tables, full table scanning risks, etc., and medium-risk issues, such as full index scanning, etc. If it is determined that there is a risk, the SQL statement with performance risk, execution plan details, risk level and other information can be recorded in detail. Among them, the risk rule library can be customized according to different database types.

[0098] 5. Send notification: After the scan is completed, if it is determined that the current application has performance risks, this device can automatically send an alarm notification to relevant personnel for timely processing.

[0099] It can be seen that the application risk identification method provided in the embodiment of the present application, for the application to be identified, first extracts the corresponding SQL statement to be analyzed from its corresponding log file, and then associates the database of the application to be identified to obtain the execution interpretation plan of each SQL statement to be analyzed, and then uses the preset risk rule library to implement the risk analysis of each execution interpretation plan, thereby realizing the risk identification of the application to be identified, that is, realizing automated application risk identification, with better accuracy and efficiency, and this technical solution does not affect the normal operation of the application, can effectively and timely prevent application performance risks, and further ensure the security of application information.

[0100] An embodiment of the present application provides an application risk identification device.

[0101] Please refer to Figure 3 , Figure 3 This is a schematic diagram of the structure of an application risk identification device provided by the present application. The application risk identification device may include:

[0102] Determination module 1, used to determine the application to be identified and obtain the log file of the application to be identified;

[0103] Extraction module 2, used to extract information from the log file and obtain the SQL statement to be analyzed corresponding to the application to be identified;

[0104] An acquisition module 3 is used to acquire, for each SQL statement to be analyzed, an execution explanation plan of the SQL statement to be analyzed in the database of the application to be identified;

[0105] The analysis module 4 is used to analyze each execution explanation plan using a preset risk rule library to determine whether the application to be identified is a risk application.

[0106] It can be seen that the application risk identification device provided in the embodiment of the present application, for the application to be identified, first extracts the corresponding SQL statement to be analyzed from its corresponding log file, and then associates the database of the application to be identified to obtain the execution interpretation plan of each SQL statement to be analyzed, and then uses the preset risk rule library to implement the risk analysis of each execution interpretation plan, thereby realizing the risk identification of the application to be identified, that is, realizing automated application risk identification, with better accuracy and efficiency, and this technical solution does not affect the normal operation of the application, can effectively and timely prevent application performance risks, and further ensure the security of application information.

[0107] In one embodiment of the present application, the above-mentioned extraction module 2 can be specifically used to extract information from log files to obtain all SQL statements corresponding to the application to be identified; for each SQL statement, perform functional analysis on the SQL statement to determine the statement function of the SQL statement; deduplicate all SQL statements according to the statement function of each SQL statement to obtain the SQL statement to be analyzed.

[0108] In one embodiment of the present application, the above-mentioned extraction module 2 can be specifically used to extract information from log files to obtain SQL statements to be analyzed corresponding to the application to be identified, including: extracting information from log files to obtain all SQL statements corresponding to the application to be identified; for each SQL statement, calculating the similarity between the abstract syntax tree structure of the SQL statement and the abstract syntax tree structures of other SQL statements; deduplicating all SQL statements according to each similarity to obtain the SQL statement to be analyzed.

[0109] In one embodiment of the present application, the application risk identification device may also include a filtering module, which is used to extract information from the log file as mentioned above and obtain the SQL statements to be analyzed corresponding to the application to be identified. For each SQL statement to be analyzed, use a preset whitelist to identify the SQL statement to be analyzed to determine whether the SQL statement to be analyzed is a risk-free SQL statement; and eliminate the risk-free SQL statements from all SQL statements to be analyzed.

[0110] In one embodiment of the present application, the preset risk rule base includes a multi-level risk rule base, and the above-mentioned analysis module 4 can be specifically used to match the execution interpretation plan with each level of risk rule base for each execution interpretation plan to determine whether the execution interpretation plan hits the risk rule base at each level; when all execution interpretation plans do not hit any level of risk rule base, it is determined that the application to be identified is not a risk application; when any execution interpretation plan hits any level of risk rule base, it is determined that the application to be identified is a risk application.

[0111] In one embodiment of the present application, the application risk identification device may also include a recording module for generating and saving a risk log corresponding to the risk application when the application to be identified is determined to be a risk application; wherein the risk log includes application information of the risk application, SQL statements corresponding to the execution interpretation plan that hits the multi-level risk rule library, the execution interpretation plan that hits the multi-level risk rule library, the hit rules of the execution interpretation plan, and a combination of one or more risk levels.

[0112] In one embodiment of the present application, the above-mentioned determination module 1 can be specifically used to determine the application to be identified, and start the scheduled task corresponding to the application to be identified; and obtain the log file of the application to be identified according to the scheduled task.

[0113] For an introduction to the device provided in the embodiments of the present application, please refer to the above method embodiments, and the present application will not elaborate on them here.

[0114] An embodiment of the present application provides an electronic device.

[0115] Please refer to Figure 4 , Figure 4 This is a schematic diagram of the structure of an electronic device provided in this application, and the electronic device may include:

[0116] A memory 11, used for storing computer programs;

[0117] The processor 10 can implement the steps of any one of the above-mentioned application risk identification methods when executing a computer program.

[0118] like Figure 4 , which is a schematic diagram of the composition structure of an electronic device, the electronic device may include: a processor 10, a memory 11, a communication interface 12 and a communication bus 13. The processor 10, the memory 11 and the communication interface 12 all communicate with each other through the communication bus 13.

[0119] In the embodiment of the present application, the processor 10 may be a central processing unit (CPU), an application specific integrated circuit, a digital signal processor, a field programmable gate array or other programmable logic devices, etc.

[0120] The processor 10 may call a program stored in the memory 11. Specifically, the processor 10 may execute operations in an embodiment of the application risk identification method.

[0121] The memory 11 is used to store one or more programs, which may include program codes, and the program codes include computer operation instructions. In the embodiment of the present application, the memory 11 at least stores programs for implementing the following functions:

[0122] Determine the application to be identified and obtain the log file of the application to be identified;

[0123] Extract information from the log file to obtain the SQL statement to be analyzed corresponding to the application to be identified;

[0124] For each SQL statement to be analyzed, obtaining an execution explanation plan of the SQL statement to be analyzed in the database of the application to be identified;

[0125] Use the preset risk rule base to analyze each execution explanation plan to determine whether the application to be identified is a risky application.

[0126] In a possible implementation, the memory 11 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and an application required for at least one function, etc.; the data storage area may store data created during use.

[0127] In addition, the memory 11 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device or other volatile solid-state storage device.

[0128] The communication interface 12 may be an interface of a communication module, and is used to connect to other devices or systems.

[0129] Of course, it should be noted that Figure 4 The structure shown does not constitute a limitation on the electronic device in the embodiment of the present application. In actual applications, the electronic device may include Figure 4 More or fewer components than shown, or combinations of certain components.

[0130] An embodiment of the present application provides a computer-readable storage medium.

[0131] The computer-readable storage medium provided in the embodiment of the present application stores a computer program, and when the computer program is executed by a processor, the steps of any one of the above-mentioned application risk identification methods can be implemented.

[0132] The computer-readable storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0133] For an introduction to the computer-readable storage medium provided in the embodiments of the present application, please refer to the above method embodiments, and the present application will not elaborate on them here.

[0134] The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.

[0135] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0136] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0137] The technical solution provided by the present application is described in detail above. The principle and implementation method of the present application are described in detail using specific examples herein, and the description of the above embodiments is only used to help understand the method and core idea of ​​the present application. It should be pointed out that for ordinary technicians in this technical field, without departing from the principle of the present application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the scope of protection of the present application.

Claims

1. A method for identifying application risks, characterized in that: include: Determine an application to be identified, and obtain a log file of the application to be identified; Extracting information from the log file to obtain the SQL statement to be analyzed corresponding to the application to be identified; For each SQL statement to be analyzed, obtaining an execution explanation plan of the SQL statement to be analyzed in a database of the application to be identified; Each of the execution explanation plans is analyzed using a preset risk rule library to determine whether the application to be identified is a risk application.

2. The application risk identification method according to claim 1, characterized in that: The extracting information from the log file to obtain the SQL statement to be analyzed corresponding to the application to be identified includes: Extracting information from the log file to obtain all SQL statements corresponding to the application to be identified; For each SQL statement, performing functional analysis on the SQL statement to determine the statement function of the SQL statement; All SQL statements are deduplicated according to the statement functions of the SQL statements to obtain the SQL statements to be analyzed.

3. The application risk identification method according to claim 1, characterized in that: The extracting information from the log file to obtain the SQL statement to be analyzed corresponding to the application to be identified includes: Extracting information from the log file to obtain all SQL statements corresponding to the application to be identified; For each SQL statement, calculating the similarity between the abstract syntax tree structure of the SQL statement and the abstract syntax tree structures of other SQL statements; All SQL statements are deduplicated according to the similarities to obtain the SQL statements to be analyzed.

4. The application risk identification method according to claim 2 or 3, characterized in that: After extracting information from the log file to obtain the SQL statement to be analyzed corresponding to the application to be identified, the method further includes: For each SQL statement to be analyzed, the SQL statement to be analyzed is identified using a preset whitelist to determine whether the SQL statement to be analyzed is a risk-free SQL statement; The risk-free SQL statements are eliminated from all the SQL statements to be analyzed.

5. The application risk identification method according to claim 1, characterized in that: The preset risk rule base includes a multi-level risk rule base, and the use of the preset risk rule base to analyze each of the execution explanation plans to determine whether the application to be identified is a risk application includes: For each execution explanation plan, the execution explanation plan is matched with each level of risk rule base to determine whether the execution explanation plan hits each level of risk rule base; When all the execution explanation plans do not hit any level of risk rule base, determining that the application to be identified is not the risk application; When any of the execution explanation plans hits any level of risk rule base, the application to be identified is determined to be the risk application.

6. The application risk identification method according to claim 5, characterized in that: Also includes: When it is determined that the application to be identified is the risk application, generating and saving a risk log corresponding to the risk application; Among them, the risk log includes application information of the risk application, SQL statements corresponding to the execution explanation plan that hits the multi-level risk rule library, the execution explanation plan that hits the multi-level risk rule library, the hit rules of the execution explanation plan and one or more combinations of risk levels.

7. The application risk identification method according to claim 1, characterized in that: The step of determining the application to be identified and obtaining the log file of the application to be identified includes: Determine the application to be identified, and start the scheduled task corresponding to the application to be identified; Obtain the log file of the application to be identified according to the scheduled task.

8. An application risk identification device, characterized in that: include: A determination module, used to determine the application to be identified and obtain the log file of the application to be identified; An extraction module, used to extract information from the log file to obtain the SQL statement to be analyzed corresponding to the application to be identified; An acquisition module, configured to acquire, for each SQL statement to be analyzed, an execution explanation plan of the SQL statement to be analyzed in a database of the application to be identified; The analysis module is used to analyze each of the execution explanation plans using a preset risk rule library to determine whether the application to be identified is a risk application.

9. An electronic device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the application risk identification method as described in any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the application risk identification method according to any one of claims 1 to 7 are implemented.

Images