Database automated audit method, system, equipment and storage medium

Abstract

The present invention relates to the field of database audit technology, specifically to a database automated audit method, system, device and storage medium, the method comprising obtaining the management authority of the database; constructing a topological map of the database; performing comparative analysis on the topological map and the preset protection map to determine the protection measures not set in the topological map; performing fusion analysis on the unset protection measures, the topological map, the preset protection map and the user's input information to obtain an audit strategy; and auditing the database according to the audit strategy to achieve comprehensive protection. The present invention solves the problem that the traditional Mysql database audit strategy is mainly set from a certain angle, such as user access rights; however, such an audit strategy lacks countermeasures from other angles such as network vulnerability protection or network attack protection, and cannot fully guarantee the security of data in the database.

Description

Technical Field

[0001] The present invention relates to the technical field of database auditing, and in particular to a database automated auditing method, system, equipment and storage medium. Background Art

[0002] With the rapid development of information technology and data storage technology, the amount of stored data is growing exponentially. As the value of data stored in the database increases, the database faces increased security risks from internal errors or external attacks, such as user unauthorized operations and malicious intrusions that lead to sensitive information leakage in the database, but it is impossible to effectively trace and audit it afterwards. Therefore, data security protection strategies have gradually become the focus of the database development process.

[0003] A large amount of sensitive data is stored in the database. If the data is lost or leaked, the harm caused is very huge. In order to prevent data resource leakage, discover and prohibit malicious operations, and respond to network attacks, the security of database data plays an important role. Audit technology related to database security has also developed rapidly with the development of Internet technology. Database auditing focuses on security events, based on comprehensive auditing and precise auditing, records users' operations on the database in real time, and issues real-time alerts for risky behaviors encountered by the database.

[0004] At present, the traditional MySQL database audit strategy is mainly set from a certain perspective, such as user access rights; however, such an audit strategy lacks countermeasures from other perspectives such as network vulnerability protection or network attack protection, and cannot fully guarantee the security of data in the database. In addition, as the audit time increases, the log data of the database audit will occupy more and more storage space. The traditional log data storage method only uses the same simple data compression method to compress the data, and does not reduce the data volume according to the storage time of the log data, resulting in the log data occupying more storage space.

[0005] Therefore, the present invention provides a database automated audit method, system, device and storage medium to solve the above problems. Summary of the invention

[0006] In view of the above situation, in order to overcome the defects of the prior art, the present invention provides a database automated audit method, system, device and storage medium to solve the problem that the above-mentioned traditional MySQL database audit strategy is mainly set from a certain angle, such as user access rights; however, such an audit strategy lacks response measures from other angles such as network vulnerability protection or network attack protection, and cannot fully guarantee the security of data in the database.

[0007] In order to achieve the above object, the technical solution adopted by the present invention is:

[0008] In a first aspect, the present invention provides a database automated audit method, the method comprising:

[0009] After obtaining the management authority of the database, a temporary copy of the data already recorded in the database is made to obtain temporary data; the correlation and authority setting analysis of the temporary data and the design information of the database is performed to construct a topological map of the database; a comparative analysis is performed based on the topological map and the preset protection map to determine the protection measures not set in the topological map; a fusion analysis is performed on the unset protection measures, the topological map, the preset protection map and the user's input information to obtain the audit strategy for database auditing; and the database is audited according to the audit strategy.

[0010] Preferably, the analysis of the association and permission setting of the temporary data and the design information of the database to construct a topological map of the database includes:

[0011] According to the mapping relationship between each temporary data, an initial map of the relationship between the corresponding types of each temporary data is constructed; according to the permission setting data in each temporary data, the permission setting information of each user is determined; the password data in each temporary data is analyzed and evaluated to obtain the current password protection information; according to the initial map, permission setting information, and password protection information, the design information of the database is screened and analyzed to obtain a second map; the initial map, permission setting information, password protection information, and the second map are fused and analyzed to obtain a topological map of the database.

[0012] Preferably, the design information of the database is screened and analyzed according to the initial graph, permission setting information, and password protection information to obtain a second graph, including: performing data analysis and deduplication on the design information of the database to obtain characteristic data; screening and clearing the initial graph, permission setting information, and password protection information according to the characteristic data to obtain cleared key data; and constructing a second graph based on the key data.

[0013] Preferably, the preset protection map at least includes an audit frequency table, a user information protection level table, a password protection level table, a data transmission channel encryption table, and encryption tables corresponding to each level.

[0014] Preferably, the fusion analysis of the unset protection measures, topology map, preset protection map and user input information to obtain the audit strategy of the database audit includes:

[0015] Perform feature extraction on the user's input information to obtain the key features of the input information; establish an initial audit map based on unset protection measures, topology maps and preset protection maps; adjust the map information in the initial audit map based on the key features to obtain an audit map; determine the audit strategy for database auditing based on the audit map.

[0016] Preferably, the auditing of the database according to the audit policy includes: obtaining the newly added adjustment policy in the audit policy; querying and deploying the corresponding subroutine according to the adjustment policy; controlling the subroutine according to the control program corresponding to the control policy in the audit policy to realize the audit of the database.

[0017] Preferably, after auditing the database according to the audit strategy, the database automated audit method also includes: analyzing the audit log data, screening out the initial sub-log data whose frequency of repeated data is greater than a preset value to obtain the sub-log data; establishing a first compression mapping library with each sub-log data and the corresponding mapping label; performing a sameness analysis on each sub-log data of the first compression mapping library, and performing character replacement on repeated words to obtain a second compression mapping library; using the first compression mapping library to compress and back up the audit log data of a first set date interval, and using the second compression mapping library to compress and back up the audit log data of a second set date interval.

[0018] In a second aspect, the present invention provides a database automated audit system, the system comprising:

[0019] The data acquisition module, after obtaining the management authority of the database, temporarily copies the data already recorded in the database to obtain temporary data.

[0020] The graph construction module analyzes the relevance and permission settings of temporary data and database design information to build a topological graph of the database.

[0021] The data analysis module performs comparative analysis based on the topology map and the preset protection map to determine the protection measures that are not set in the relationship map.

[0022] The policy formulation module integrates and analyzes the unset protection measures, topology maps, preset protection maps and user input information to obtain the audit strategy for database auditing.

[0023] The policy implementation module audits the database according to the audit policy.

[0024] In a third aspect, the present invention provides a machine-readable storage medium having a machine executable program stored thereon, which, when executed by a processor, implements the database automated auditing method described in any one of the methods of the first aspect.

[0025] In a fourth aspect, the present invention provides a computer device comprising a memory, a processor, and a machine executable program stored in the memory and running on the processor, and when the processor executes the machine executable program, it can implement any database automated audit method described in the method of the first aspect.

[0026] The beneficial effects of the present invention are:

[0027] 1. Based on the existing audit strategy of Mysql database, after obtaining all the management rights of the Mysql database currently used by the enterprise, the present invention performs correlation analysis and permission setting analysis based on the current storage data of the database and the design information of the database to construct the topology map of the current database; then, a comparative analysis is performed based on the topology map and the preset protection map to find and determine the protection measures that are not set in the topology map; then the unset protection measures, topology map, preset protection map and user input information are integrated and analyzed to obtain an audit strategy that conforms to the current database audit; finally, the database is audited according to the audit strategy to realize the monitoring of the database, improve the security of the information stored in the database, and realize comprehensive protection. The present invention solves the problem that the traditional Mysql database audit strategy is mainly set from a certain angle, such as user access rights; but such an audit strategy lacks countermeasures from other angles such as network vulnerability protection or network attack protection, and cannot fully guarantee the security of data in the database.

[0028] 2. The present invention also provides two backup methods for database audit log data. The first method is used to back up recent audit log data so as to increase the data processing speed when processing audit log data. The second method is used to back up audit log data with a longer interval to reduce the data volume and save data storage space. Through the above two backup methods, the present invention solves the problem that the traditional log data compression method does not perform a processing operation to reduce the data volume of the log data according to the storage time of the log data, resulting in the log data occupying more storage space. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 A schematic flow chart of the database automatic audit method of the present invention;

[0030] Figure 2 A schematic structural diagram of a machine-readable storage medium of the present invention. DETAILED DESCRIPTION

[0031] The following will refer to the attached Figure 1 To Attachment Figure 2The embodiments of the present invention are described in detail. It should be understood by those skilled in the art that these embodiments are only used to explain the technical principles of the present invention and are not intended to limit the protection scope of the present invention.

[0032] Preferably, the database mentioned in the present invention refers to a MySQL database.

[0033] A database automated audit method, as shown in the attached Figure 1 As shown, the following steps are included:

[0034] Step S11: After obtaining the management authority of the database, temporarily copy the data already recorded in the database to obtain temporary data.

[0035] Step S12: Analyze the correlation and authority settings of the temporary data and the design information of the database to construct a topological map of the database.

[0036] Specifically, when obtaining temporary data, data is obtained from the database in batches; after the currently obtained temporary data is analyzed and processed, the next batch of data is deleted and obtained until the data analysis is completed to obtain a complete database knowledge graph. Alternatively, after all the data in the database is copied, data analysis is performed in combination with the design information of the database to obtain the topology map of the database, and a visual display is performed for reference and record by the staff. Among them, the design information of the database includes but is not limited to the design framework of the database, the relationship between each data, etc., which can be relevant information when designing various databases, so that a more complete topology map can be obtained when analyzing temporary data and database design information. The topology map and the preset protection map are both audit frameworks for database audits. The topology map is the audit framework corresponding to the database that currently needs to add audit measures; the preset protection map is an overall audit framework constructed by various protection measures of the Mysql database and common protection vulnerabilities, and each item in the audit framework is pre-designed with a corresponding audit procedure according to the level.

[0037] Step S13: Perform comparative analysis based on the topology map and the preset protection map to determine the protection measures that are not set in the topology map.

[0038] Step S14: Perform a fusion analysis on the unset protection measures, topology map, preset protection map and user input information to obtain the audit strategy for database audit.

[0039] Step S15: Audit the database according to the audit policy.

[0040] In an optional implementation, the analysis of temporary data is canceled, and only the design information of the database is analyzed, and the audit framework of the current database is analyzed based on the design information of the database; or, considering that when an enterprise obtains a database for use, it may not be able to obtain the design information corresponding to the design rules of the database, a method is provided for analyzing only temporary data and obtaining the audit framework of the current database based on the temporary data.

[0041] Through the implementation of steps S11 to S15, the present invention can be based on the existing audit strategy of the Mysql database, after obtaining all the management rights of the Mysql database currently used by the enterprise, and then based on the current storage data of the database and the design information of the database, perform correlation analysis and permission setting analysis to build the topology map of the current database; then perform comparative analysis based on the topology map and the preset protection map to find and determine the protection measures that are not set in the topology map; then perform fusion analysis on the unset protection measures, topology map, preset protection map and user input information to obtain an audit strategy that conforms to the current database audit; finally, audit the database according to the audit strategy to achieve database monitoring, improve the security of information stored in the database, and achieve comprehensive protection. The present invention solves the problem that the traditional Mysql database audit strategy is mainly set from a certain angle, such as user access rights; but such an audit strategy lacks countermeasures from other angles such as network vulnerability protection or network attack protection, and cannot fully guarantee the security of data in the database.

[0042] In one embodiment of the present invention, the temporary data and the design information of the database are analyzed for relevance and permission settings to construct a topological map of the database, including:

[0043] According to the mapping relationship between each temporary data in the database, an initial map of the relationship between the corresponding types of each temporary data is constructed; according to the permission setting in each temporary data, the permission setting information of each user is determined; the password data in each temporary data is analyzed and evaluated to obtain the current password protection information; according to the initial map, permission setting information, and password protection information, the design information of the database is screened and analyzed to obtain a second map; the initial map, permission setting information, password protection information, and the second map are fused and analyzed to obtain a topological map of the database.

[0044] Preferably, the corresponding types of each temporary data include but are not limited to the names of each temporary data, the names of the database tables, and the names of each sub-database. When constructing the initial map, types not recorded in the initial map are added by quick screening, types already recorded in the initial map are filtered, and the relationship between each type is displayed in the initial map.

[0045] Preferably, the permission setting information at least includes each permission level, the accessible information corresponding to each permission level, the verification method of each permission level, etc.

[0046] Preferably, the information in the second graph includes but is not limited to the audit frequency and monitoring methods adopted by the current database.

[0047] Specifically, this embodiment obtains the topological map of the database by integrating and analyzing the initial map, permission setting information, password protection information, and the second map, and displays the topological map in a visual manner to facilitate intuitive reference by staff when viewing it later; and subsequent steps analyze the topological map.

[0048] In one embodiment of the present invention, the design information of the database is screened and analyzed based on the initial graph, permission setting information, and password protection information to obtain a second graph, including: performing data analysis and deduplication on the design information of the database to obtain characteristic data; screening and clearing the initial graph, permission setting information, and password protection information based on the characteristic data to obtain cleared key data; and constructing a second graph based on the key data.

[0049] Specifically, the data analysis method includes but is not limited to analyzing the key information in the design information based on the preset word library, and obtaining the characteristic data based on the key information; after obtaining the current characteristic data, when screening again, no feature extraction is performed when the same information is found. The initial map, permission setting information, and password protection information are screened based on the characteristic data to remove duplicate data to obtain the cleared key data; based on the key data and the relationship between the key data, a second map is constructed.

[0050] Through the setting method of this embodiment, the present invention can quickly screen and analyze the design information of the database including the initial map, permission setting information, and password protection information to improve the processing speed and data analysis speed.

[0051] In one embodiment of the present invention, the preset protection map includes at least an audit frequency table, a user information protection level table, a password protection level table, a data transmission channel encryption table, and encryption methods corresponding to each level.

[0052] Specifically, an audit frequency table is established based on the relationship between the amount of data in the database, the data processing rate, and the audit frequency. The user information protection level table includes multiple sub-user information protection level tables, and each table is provided with a corresponding execution program. The password protection level table is provided with different levels of password setting requirements and corresponding data transmission requirements. In addition, a mapping relationship is provided between the audit frequency table, the user information protection level table, the password protection level table, the data transmission channel encryption table, and some data corresponding to the encryption method of each level in the preset protection map. For example, when the user level is the highest level, the highest level of data audit frequency is the highest, and the data transmission channel adopts the most rigorous encryption method in the data transmission channel encryption table.

[0053] In one embodiment of the present invention, the fusion analysis of unset protection measures, topological maps, preset protection maps and user input information to obtain an audit strategy for database audit includes: extracting features from user input information to obtain key features of the input information; establishing an initial audit map based on unset protection measures, topological maps and preset protection maps; adjusting the map information in the initial audit map based on the key features to obtain an audit map; and determining the audit strategy for database audit based on the audit map.

[0054] Preferably, the user's input information is obtained in the form of text and / or voice. The content of the input information includes encryption method, user information hiding method, data transmission encryption method, permission setting method, frequency of data monitoring and preset time period, etc. There are two ways to extract the features of the user's input information. The first way is: when the input information is in the form of text, the key features of the input information are determined based on a preset feature word library; the second way is: when the input information is in the form of audio, the audio information is converted into text information through a speech recognition model, and then the key features of the input information are determined based on a preset feature word library.

[0055] Among them, the content of the graph information in the initial audit graph adjusted according to key features at least includes the encryption method of the application, the data transmission channel, the authority setting, the monitoring frequency of the database audit, the number of people with administrator authority, the verification method of data transmission, etc.

[0056] Through the implementation of this embodiment, the present invention can adjust the audit strategy of the database audit according to the user's input information, so as to make the database audit strategy more in line with the user's needs and provide security for the customer's database audit.

[0057] In one embodiment of the present invention, the auditing of the database according to the audit policy includes: obtaining the newly added adjustment policy in the audit policy; querying and deploying the corresponding subroutine according to the adjustment policy; controlling the subroutine according to the control program corresponding to the control policy in the audit policy to realize the audit of the database.

[0058] Through the setting method of this embodiment, the present invention can adjust the audit policy used by the current database according to the audit policy obtained by analysis; on the basis of the current audit policy, add or change some new audit procedures to make the audit speed and audit efficiency of the database faster, while improving the security of user data and sensitive data in the database.

[0059] In one embodiment of the present invention, after auditing the database according to the audit strategy, the database automated audit method also includes: analyzing the audit log data, screening out the audit log data with a repeated data frequency greater than a preset value to obtain sub-log data; establishing a first compression mapping library with each sub-log data and a corresponding mapping label; performing a sameness analysis on each sub-log data of the first compression mapping library, and performing character replacement on repeated words to obtain a second compression mapping library; using the first compression mapping library to compress and back up the audit log data of a first set date interval, and using the second compression mapping library to compress and back up the audit log data of a second set date interval.

[0060] Preferably, the first set date interval is from 3 months ago to the present time, and the second set date interval is from the beginning of recording to 3 months ago.

[0061] Through the setting of this embodiment, the present invention sets two backup methods for database review log data. The first method uses the first compression mapping library method to back up recent review log data so as to improve the data processing speed when processing the review log data; the second method uses the second compression mapping library method to back up review log data with a longer interval time to reduce the data volume and save data storage space. Through the setting of this embodiment, the present invention solves the problem that the traditional log data compression method does not perform a processing operation to reduce the data volume of the log data according to the storage time of the log data, resulting in the log data occupying more storage space.

[0062] In an optional embodiment of the present invention, when executing the method in steps S11 to S15 for data analysis, a corresponding artificial intelligence model is used for analysis to obtain corresponding results, thereby improving the data analysis speed so as to quickly obtain an audit strategy, and adjust the audit method of the current database according to the audit strategy to improve the monitoring of the database and improve the security of information stored in the database.

[0063] In one embodiment of the present invention, in the process of applying the database automation audit method of the present invention to analyze the Mysql database, adjust the audit strategy, and realize the database automation audit, at the first docking, the system applying the database automation audit method of the present invention obtains the administrator operation authority of the audited database and first performs data analysis on the user information recorded in the database. The analyzed user information includes but is not limited to the user operation authority level, the user's modification authority, the user's unauthorized operation number prompt, the user's access number, the maximum amount of data downloaded by the user, the verification of the user's access terminal, the face recognition verification, etc.

[0064] When auditing the database with the adjusted audit strategy, all operations of users accessing the database are fully monitored at the preset frequency. The frequency of audit monitoring does not affect the performance of the database. In addition, the preset frequency can change with the operation frequency of the database. The higher the operation frequency, the lower the monitoring frequency, but the monitoring frequency is at least maintained at least once for the information logged in for the first time in the abnormal data list. When responding to network attacks, the recorded network attacks are identified and blocked based on the preset network attack protection model. Different data access channels are set for users with different permissions to avoid the leakage of sensitive data in the database; or sensitive data can be encrypted or hidden according to actual conditions, and only designated users can perform various operations through special instructions. And operations are limited according to the user's level of authority, prompts are given for abnormal access locations, or related operations are prohibited.

[0065] The present invention also provides a database automation audit system, which is used to execute the database automation audit method described in any one of the above embodiments, including a data acquisition module, a graph construction module, a data analysis module, a strategy formulation module and a strategy implementation module.

[0066] The data acquisition module, after acquiring the management authority of the database, temporarily copies the data already recorded in the database to obtain temporary data.

[0067] The graph construction module analyzes the relevance and permission settings of temporary data and database design information to build a topological graph of the database.

[0068] The data analysis module performs comparative analysis based on the topology map and the preset protection map to determine the protection measures that are not set in the relationship map.

[0069] The policy formulation module integrates and analyzes the unset protection measures, topology maps, preset protection maps and user input information to obtain the audit strategy for database auditing.

[0070] The policy implementation module audits the database according to the audit policy.

[0071] In the database automation audit system, the security audit of the database is realized through the mutual cooperation between the modules, which mainly includes: after obtaining all the management rights of the Mysql database currently used by the enterprise, the correlation analysis and permission setting analysis are performed based on the current storage data of the database and the design information of the database to build the topology map of the current database; then, a comparative analysis is performed based on the topology map and the preset protection map to find and determine the protection measures that are not set in the topology map; then the unset protection measures, topology map, preset protection map and user input information are integrated and analyzed to obtain an audit strategy that conforms to the current database audit; finally, the database is audited according to the audit strategy to realize the monitoring of the database, improve the security of the information stored in the database, and realize comprehensive protection. The invention solves the problem that the traditional Mysql database audit strategy is mainly set from a certain angle, such as user access rights, through the mutual cooperation between the above modules; but such an audit strategy lacks countermeasures from other angles such as network vulnerability protection or network attack protection, and cannot fully guarantee the security of data in the database.

[0072] The present invention also provides a machine-readable storage medium on which a machine executable program is stored. When the machine executable program is executed by a processor, the database automatic audit method described in any one of the above embodiments is implemented.

[0073] The present invention also provides a computer device, comprising a memory, a processor, and a machine executable program stored in the memory and running on the processor, and the processor can implement the database automatic audit method described in any one of the above embodiments when executing the machine executable program.

[0074] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0075] It should be noted that in the description of the present invention, the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inner", "outer" and the like indicating directions or positional relationships are based on the directions or positional relationships shown in the drawings, which are only for the convenience of description, and do not indicate or imply that the device or element must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, the terms "first", "second", and "third" are used for descriptive purposes only, and cannot be understood as indicating or implying relative importance.

[0076] In addition, it should be noted that in the description of the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For those skilled in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0077] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0078] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0079] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0080] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0081] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0082] So far, the technical solutions of the present invention have been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it is easy for those skilled in the art to understand that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will fall within the protection scope of the present invention.

Claims

1. A database automated audit method, characterized in that: include: After obtaining the management authority of the database, temporarily copy the data already recorded in the database to obtain temporary data; Analyze the association and permission settings of temporary data and database design information to build a topological map of the database; Compare and analyze the topology map and the preset protection map to determine the protection measures that are not set in the topology map; Perform fusion analysis on unset protection measures, topology maps, preset protection maps and user input information to obtain the audit strategy for database audit, specifically including: extracting features from user input information to obtain key features of input information; establishing an initial audit map based on unset protection measures, topology maps and preset protection maps; adjusting the map information in the initial audit map based on key features to obtain an audit map; determining the audit strategy for database audit based on the audit map; Audit the database according to the audit policy.

2. The audit method according to claim 1, characterized in that: The analysis of the association and permission setting of the temporary data and the database design information to construct a topological map of the database includes: According to the mapping relationship between each temporary data, an initial map of the relationship between the corresponding types of each temporary data is constructed; according to the permission setting data in each temporary data, the permission setting information of each user is determined; the password data in each temporary data is analyzed and evaluated to obtain the current password protection information; according to the initial map, permission setting information, and password protection information, the design information of the database is screened and analyzed to obtain a second map; the initial map, permission setting information, password protection information, and the second map are fused and analyzed to obtain a topological map of the database.

3. The audit method according to claim 2, characterized in that: The design information of the database is screened and analyzed according to the initial graph, the permission setting information, and the password protection information to obtain a second graph, including: performing data analysis and deduplication on the design information of the database to obtain characteristic data; screening and clearing the initial graph, the permission setting information, and the password protection information according to the characteristic data to obtain cleared key data; and constructing a second graph based on the key data.

4. The audit method according to claim 1, characterized in that: The preset protection map at least includes an audit frequency table, a user information protection level table, a password protection level table, a data transmission channel encryption table, and encryption tables corresponding to each level.

5. The audit method according to claim 1, characterized in that: The auditing of the database according to the audit strategy includes: Obtain the newly added adjustment strategy in the audit strategy; query and deploy the corresponding subprogram according to the adjustment strategy; control the subprogram according to the control program corresponding to the control strategy in the audit strategy to realize the audit of the database.

6. The audit method according to claim 1, characterized in that: After auditing the database according to the audit policy, the following is also included: The audit log data is analyzed to filter out the audit log data with a repetitive data frequency greater than a preset value to obtain sub-log data; a first compression mapping library is established with each sub-log data and a corresponding mapping label; a sameness analysis is performed on each sub-log data of the first compression mapping library, and characters are replaced for repeated words to obtain a second compression mapping library; the first compression mapping library is used to compress and back up the audit log data of a first set date interval, and the second compression mapping library is used to compress and back up the audit log data of a second set date interval.

7. A database automated audit system, the audit system being used to execute the database automated audit method according to any one of claims 1 to 6, characterized in that: include: The data acquisition module, after obtaining the management authority of the database, temporarily copies the data already recorded in the database to obtain temporary data; The graph construction module analyzes the relevance and permission settings of temporary data and database design information to build a topological graph of the database; The data analysis module performs comparative analysis based on the topology map and the preset protection map to determine the protection measures that are not set in the relationship map; The strategy formulation module integrates and analyzes the unset protection measures, topology maps, preset protection maps, and user input information to obtain the audit strategy for database audit, including: extracting features from user input information to obtain key features of the input information; establishing an initial audit map based on the unset protection measures, topology maps, and preset protection maps; adjusting the map information in the initial audit map based on the key features to obtain the audit map; and determining the audit strategy for database audit based on the audit map; The policy implementation module audits the database according to the audit policy.

8. A machine-readable storage medium having a machine executable program stored thereon, wherein the machine executable program, when executed by a processor, implements the database automated audit method according to any one of claims 1 to 6.

9. A computer device comprising a memory, a processor, and a machine executable program stored in the memory and running on the processor, wherein the processor implements the database automated audit method according to any one of claims 1 to 6 when executing the machine executable program.

Images