Database attack threat analysis method and device, equipment and storage medium

Abstract

The invention relates to a data security technology, and discloses a database attack threat analysis method, which comprises the following steps of: capturing database traffic of a network card according to a port list of the network card; decoding an operation statement in the database traffic to obtain a database operation statement; and converting the database operation statement into a database operation event, performing threat analysis on the database operation event to obtain a threat analysis result, and alarming the threat analysis result by adopting a preset alarm mode. The invention further provides a database attack threat analysis device and equipment and a storage medium. According to the method, the comprehensiveness and accuracy of database attack threat analysis can be improved.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a database attack threat analysis method, device, equipment and storage medium. Background Art

[0002] Enterprise databases usually store a large amount of sensitive information. If sensitive information is stolen or leaked, it will cause serious losses to the enterprise. Ensuring that the database is protected from attack threats can avoid the legal risks brought about by privacy leaks in the database.

[0003] Existing database attack threat analysis usually installs an audit plug-in in the database, uses the audit plug-in to record all database operations to form an audit log, and then uses the audit log to perform database attack threat analysis. However, this method has the problem of audit log accumulation, which causes database performance to degrade. In addition, although this method records all database operation records, it cannot perform in-depth analysis of the database data and cannot analyze potential attack threats. Summary of the invention

[0004] The present invention provides a database attack threat analysis method, device, equipment and storage medium, which can improve the comprehensiveness and accuracy of database attack threat analysis.

[0005] To achieve the above object, the present invention provides a database attack threat analysis method, comprising:

[0006] Capture the database traffic of the network card according to the port list of the network card;

[0007] Decoding the operation statements in the database traffic to obtain database operation statements;

[0008] The database operation statement is converted into a database operation event, and a threat analysis is performed on the database operation event to obtain a threat analysis result, and an alarm is issued for the threat analysis result using a preset alarm method.

[0009] Optionally, capturing database traffic of the network card according to the port list of the network card includes:

[0010] Installing a traffic sniffing unit in the server where the business system is located, and using the traffic sniffing unit to capture traffic packets;

[0011] Compile the protocol sequence number field of the traffic packet into a first key, and compile the traffic packet into a first value corresponding to the protocol sequence number field and cache it locally to obtain a first key-value pair;

[0012] When the next traffic packet is captured, the source IP value of the next traffic packet is used as the second key, and the protocol sequence number field corresponding to the next traffic packet is used as the second value to obtain a second key-value pair;

[0013] The traffic packets are merged according to the first key-value pair and the second key-value pair, and database traffic is obtained after the merging is completed.

[0014] Optionally, after the merging is completed and the database traffic is obtained, the method further includes:

[0015] Pushing the database traffic to a memory ring queue of a preset size, and using an event work processor to receive the traffic packets stored in the memory ring queue;

[0016] After the event work processor receives the traffic packet stored in the memory ring queue, the event work processor decodes the traffic packet using a database decoder to obtain a decoded data entity;

[0017] The decoded data entity is sent to the transceiver unit according to the log message transmission protocol.

[0018] Optionally, decoding the operation statement in the database traffic to obtain the database operation statement includes:

[0019] The transceiver unit starts the log message transmission protocol server to receive the decoded data entity, and sends the decoded data entity to the log message event processor;

[0020] The log message event processor extracts the entity object in the decoded data entity, and performs a decoding operation on the entity object using a preset data format to obtain a database event;

[0021] The database event is transmitted to a message queue according to a tag in the database event, and an operation statement in the database event is extracted to obtain the database operation statement.

[0022] Optionally, before the transceiver unit starts the log message transmission protocol server to receive the decoded data entity, the step further includes configuring a routing distribution strategy in the transceiver unit, the steps of which include:

[0023] The data subject of the decoded data entity is extracted, and a routing distribution strategy is configured using a message forwarding channel, a message forwarding protocol, a message forwarding address, and the data subject.

[0024] Optionally, before performing threat analysis on the database operation event to obtain a threat analysis result, a threat feature library is further configured, the steps of which include:

[0025] Obtain the feature names, feature values, feature classifications and risk levels of different types of databases according to the database type;

[0026] A threat feature library is constructed according to the feature names, feature values, feature classifications, and risk levels corresponding to different types of databases.

[0027] Optionally, performing threat analysis on the database operation event to obtain a threat analysis result includes:

[0028] Obtaining a database filtering policy, and determining whether the database operation event is a whitelist filtering item according to the database filtering policy;

[0029] If the database operation event is a whitelist filtering item, determining that the database operation event is a normal operation event;

[0030] If the database operation event is not a whitelist filtering item, all operation statements in the database operation event are standardized and converted to obtain a standardized operation statement feature set;

[0031] The standardized operation statement feature set is matched with the threat feature library, and after successful matching, the threat data operation statement in the standardized operation statement feature set is identified, and the database operation event corresponding to the threat operation statement is extracted as the threat analysis result.

[0032] In order to solve the above problem, the present invention also provides a database attack threat analysis device, the device comprising:

[0033] A database traffic acquisition module is used to capture the database traffic of the network card according to the port list of the network card;

[0034] A database traffic decoding module, used for decoding operation statements in the database traffic to obtain database operation statements;

[0035] The threat analysis module is used to convert the database operation statement into a database operation event, perform threat analysis on the database operation event to obtain a threat analysis result, and use a preset alarm method to warn the threat analysis result.

[0036] In order to solve the above problem, the present invention further provides an electronic device, the electronic device comprising:

[0037] at least one processor; and,

[0038] a memory communicatively connected to the at least one processor; wherein,

[0039] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the database attack threat analysis method described above.

[0040] In order to solve the above problem, the present invention also provides a computer-readable storage medium, in which at least one computer program is stored. The at least one computer program is executed by a processor in an electronic device to implement the above-mentioned database attack threat analysis method.

[0041] The present invention captures the database traffic of the network card according to the port list of the network card, which can ensure the comprehensiveness of the captured database traffic and avoid the risk of missing dangerous database traffic. Furthermore, by decoding the operation statements in the database traffic, it is possible to record all operation events in the database traffic and trace the source of all operations on the database traffic. In addition, the database operation statements are converted into database operation events, and threat analysis is performed on the database operation events to obtain threat analysis results, which can realize threat identification using operation statements, and trace the threat operation statements obtained through analysis to database operation events, and further trace to database traffic. The above-mentioned threat analysis method can go deep into the data operation level of the database, and can improve the comprehensiveness and accuracy of database attack threat analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 A schematic diagram of a process flow of a database attack threat analysis method provided by an embodiment of the present invention;

[0043] Figure 2 An overall flow chart of a preferred embodiment of a database attack threat analysis method provided by an embodiment of the present invention;

[0044] Figure 3 A functional module diagram of a database attack threat analysis device provided by one embodiment of the present invention;

[0045] Figure 4 A schematic diagram of the structure of an electronic device for implementing a database attack threat analysis method provided by an embodiment of the present invention.

[0046] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0047] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0048] The embodiment of the present application provides a database attack threat analysis method. The execution subject of the database attack threat analysis method includes but is not limited to at least one of the electronic devices such as a server, a terminal, etc. that can be configured to execute the method provided by the embodiment of the present application. In other words, the database attack threat analysis method can be executed by software or hardware installed on a terminal device or a server device, and the software can be a blockchain platform. The server includes but is not limited to: a single server, a server cluster, a cloud server or a cloud server cluster, etc. The server can be an independent server, or it can be a cloud server that provides cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (Content Delivery Network, CDN), and basic cloud computing services such as big data and artificial intelligence platforms.

[0049] Reference Figure 1 FIG. 1 is a flow chart of a database attack threat analysis method provided by an embodiment of the present invention. In this embodiment, the database attack threat analysis method includes:

[0050] S1. Capture the database traffic of the network card according to the port list of the network card.

[0051] In the embodiment of the present invention, the port of the network card refers to an interface for generating and receiving data.

[0052] As an embodiment of the present invention, capturing database traffic of the network card according to the port list of the network card includes:

[0053] Installing a traffic sniffing unit in the server where the business system is located, and using the traffic sniffing unit to capture traffic packets;

[0054] Compile the protocol sequence number field of the traffic packet into a first key, and compile the traffic packet into a first value corresponding to the protocol sequence number field and cache it locally to obtain a first key-value pair;

[0055] When the next traffic packet is captured, the source IP value of the next traffic packet is used as the second key, and the protocol sequence number field corresponding to the next traffic packet is used as the second value to obtain a second key-value pair;

[0056] The traffic packets are merged according to the first key-value pair and the second key-value pair, and database traffic is obtained after the merging is completed.

[0057] In the embodiment of the present invention, the traffic sniffing unit refers to a tool for capturing and analyzing network traffic, mainly by monitoring data packets in the network to understand network behavior and identify potential threats and vulnerabilities.

[0058] In an embodiment of the present invention, the protocol sequence number field refers to a key field used to mark the order of obtaining data in the data transmission protocol. Its main function is to ensure the correctness and order of the traffic packet transmission process. Even if the data packets may arrive out of order during the network transmission process, the receiver can reorder the data through the sequence number field.

[0059] In the embodiment of the present invention, the key-value pair refers to a method for storing and organizing data, and is mainly composed of a unique key and an associated value.

[0060] The embodiment of the present invention verifies the protocol sequence number fields of two traffic packets through a key-value pair, and performs a traffic packet merging operation according to the protocol sequence number fields.

[0061] Furthermore, after the merging is completed and the database traffic is obtained, the method further includes:

[0062] Pushing the database traffic to a memory ring queue of a preset size, and using an event work processor to receive the traffic packets stored in the memory ring queue;

[0063] After the event work processor receives the traffic packet stored in the memory ring queue, the event work processor decodes the traffic packet using a database decoder to obtain a decoded data entity;

[0064] The decoded data entity is sent to the transceiver unit according to the log message transmission protocol.

[0065] In an embodiment of the present invention, the memory circular queue is a data structure that can be pre-allocated in memory with a fixed size, and this memory can be used cyclically in a head-to-tail manner. When the tail of the queue reaches the end of the memory, new data will continue to be stored from the beginning of the memory, forming a loop.

[0066] In the embodiment of the present invention, the preset size of the memory ring queue can be set to a 1024*1024 memory ring queue.

[0067] Before the embodiment of the present invention uses a database decoder to decode the traffic packet to obtain a decoded data entity, it is necessary to configure a database decoding logic for determining the category of the traffic packet and performing database decoding.

[0068] In an embodiment of the present invention, the database decoding logic is as follows: ① Determine whether the number of readable bytes meets the specified length. If not, return directly; ② Determine whether the traffic packet is an authentication login packet. If it is an authentication packet, the sql type record is LOGIN. The sql type is divided into LOGIN, DML, DDL, DCL, TCL, and OTHER, a total of 6; ③ Decode the traffic packet; ④ Encapsulate the traffic packet into a data entity in a specified format.

[0069] S2. Decode the operation statements in the database traffic to obtain database operation statements.

[0070] In the embodiment of the present invention, the operation statement refers to an SQL (Structured Query Language) statement formed by performing various operations on the data in the database. For example, the following statement "select * from city where city_code = '500112'" is an operation statement.

[0071] As an embodiment of the present invention, the decoding of the operation statement in the database traffic to obtain the database operation statement includes:

[0072] The transceiver unit starts the log message transmission protocol server to receive the decoded data entity, and sends the decoded data entity to the log message event processor;

[0073] The log message event processor extracts the entity object in the decoded data entity, and performs a decoding operation on the entity object using a preset data format to obtain a database event;

[0074] The database event is transmitted to a message queue according to a tag in the database event, and an operation statement in the database event is extracted to obtain the database operation statement.

[0075] In the embodiment of the present invention, the decoding entity includes but is not limited to data receiving time, data level value, data tag value, message body, etc.

[0076] Furthermore, before the transceiver unit starts the log message transmission protocol server to receive the decoded data entity, it also includes configuring a routing distribution strategy in the transceiver unit, the steps of which include:

[0077] The data subject of the decoded data entity is extracted, and a routing distribution strategy is configured using a message forwarding channel, a message forwarding protocol, a message forwarding address, and the data subject.

[0078] S3. Convert the database operation statement into a database operation event, perform threat analysis on the database operation event to obtain a threat analysis result, and use a preset alarm method to issue an alarm for the threat analysis result.

[0079] In the embodiment of the present invention, the database operation event refers to the event generated by converting a database operation statement.

[0080] As an embodiment of the present invention, before performing threat analysis on the database operation event to obtain a threat analysis result, it also includes configuring a threat feature library, and the steps include:

[0081] Obtain the feature names, feature values, feature classifications and risk levels of different types of databases according to the database type;

[0082] A threat feature library is constructed according to the feature names, feature values, feature classifications, and risk levels corresponding to different types of databases.

[0083] As an embodiment of the present invention, it also includes configuring a filtering strategy for a database, the steps are as follows:

[0084] Step 1: Set the protection object for the database and extract the relevant information of the database protection object, including database name, database type, IP address, and port number;

[0085] Step 2: Configure a filtering strategy according to the database protection object, wherein the filtering strategy includes traffic filtering and event filtering. Traffic filtering includes whitelist filtering and blacklist filtering. The main configuration information of whitelist filtering includes application, client IP, database user, etc.; the main configuration information of event filtering includes application, client IP, database user, audit mode (filtering and auditing) and filtered SQL statement regular expression.

[0086] Further, the performing threat analysis on the database operation event to obtain a threat analysis result includes:

[0087] Obtaining a database filtering policy, and determining whether the database operation event is a whitelist filtering item according to the database filtering policy;

[0088] If the database operation event is a whitelist filtering item, determining that the database operation event is a normal operation event;

[0089] If the database operation event is not a whitelist filtering item, all operation statements in the database operation event are standardized and converted to obtain a standardized operation statement feature set;

[0090] The standardized operation statement feature set is matched with the threat feature library, and after successful matching, the threat data operation statement in the standardized operation statement feature set is identified, and the database operation event corresponding to the threat operation statement is extracted as the threat analysis result.

[0091] Exemplarily, in a preferred embodiment, for different types of database operation statements (addition, deletion, modification), the above-mentioned filtering strategy and threat feature library are modified and cached locally. Among them, the filtering strategy is used to filter whether certain events are to be identified, and the feature library provides feature data for the threat identification unit. Step 1, the threat identification unit receives the transceiver unit database event, first obtains the filtering strategy, determines whether it is blacklist and whitelist filtering, whitelist releases, blacklist matches according to the configuration information, after the blacklist hits, it matches in sequence according to the event filtering rule list, the database object meets the client IP and database user conditions, obtains the event filtering rule statement, matches according to the audit and filtering mode, and performs threat feature identification for those that are not matched in the audit mode and matched in the filtering mode. Step 2, extract the operation statement in the event, use the mark to convert it, and perform special processing on the statement at the same time. The main processing includes deleting the matched bracket pair, retaining the bracket that cannot be matched directly, and converting it into a mark; empty comments (comments containing only blank characters) can be deleted, but non-empty comments must be retained. Step 3: The processed operation statements are uniformly converted to uppercase. For example, the database operation statement select * from city where city_code = '500112' is converted to: SELECT STAR FROM TABLE WHERE COL EQ VAR. The statement is segmented according to the tag to obtain the vocabulary feature set. The variance threshold is used to select the top n features that are conducive to classification, and the text vector is constructed. The extracted text vector is compared with the threat features in the threat feature library to identify the threat risk.

[0092] In an embodiment of the present invention, the preset alarm method refers to a method of informing relevant personnel of the threat risk. For example, the preset alarm method includes but is not limited to email, text message, instant messaging tool and telephone to ensure that the threat risk information can be conveyed to relevant personnel quickly and accurately.

[0093] The embodiment of the present invention captures the database traffic of the network card according to the port list of the network card, which can ensure the comprehensiveness of the captured database traffic and avoid the risk of missing dangerous database traffic. Furthermore, by decoding the operation statements in the database traffic, it is possible to record all operation events in the database traffic and trace the source of all operations on the database traffic. In addition, the database operation statements are converted into database operation events, and threat analysis is performed on the database operation events to obtain threat analysis results. It is possible to identify threats using operation statements, and trace the threat operation statements obtained through analysis to database operation events, and further trace them to database traffic. The above threat analysis method can go deep into the data operation level of the database, and can improve the comprehensiveness and accuracy of database attack threat analysis.

[0094] like Figure 2 As shown, it is an overall flow chart of a preferred embodiment of a database attack threat analysis method provided by an embodiment of the present invention.

[0095] like Figure 3 1 is a functional module diagram of a database attack threat analysis device provided by an embodiment of the present invention.

[0096] The database attack threat analysis device 100 of the present invention can be installed in an electronic device. According to the implemented functions, the database attack threat analysis device 100 can include a database traffic acquisition module 101, a database traffic decoding module 102 and a threat analysis module 103.

[0097] The module described in the present invention may also be referred to as a unit, which refers to a series of computer program segments that can be executed by a processor of an electronic device and can complete fixed functions, and is stored in a memory of the electronic device.

[0098] In this embodiment, the functions of each module / unit are as follows:

[0099] The database traffic acquisition module 101 is used to capture the database traffic of the network card according to the port list of the network card.

[0100] In the embodiment of the present invention, the port of the network card refers to an interface for generating and receiving data.

[0101] As an embodiment of the present invention, capturing database traffic of the network card according to the port list of the network card includes:

[0102] Installing a traffic sniffing unit in the server where the business system is located, and using the traffic sniffing unit to capture traffic packets;

[0103] Compile the protocol sequence number field of the traffic packet into a first key, and compile the traffic packet into a first value corresponding to the protocol sequence number field and cache it locally to obtain a first key-value pair;

[0104] When the next traffic packet is captured, the source IP value of the next traffic packet is used as the second key, and the protocol sequence number field corresponding to the next traffic packet is used as the second value to obtain a second key-value pair;

[0105] The traffic packets are merged according to the first key-value pair and the second key-value pair, and database traffic is obtained after the merging is completed.

[0106] In the embodiment of the present invention, the traffic sniffing unit refers to a tool for capturing and analyzing network traffic, mainly by monitoring data packets in the network to understand network behavior and identify potential threats and vulnerabilities.

[0107] In an embodiment of the present invention, the protocol sequence number field refers to a key field used to mark the order of obtaining data in the data transmission protocol. Its main function is to ensure the correctness and order of the traffic packet transmission process. Even if the data packets may arrive out of order during the network transmission process, the receiver can reorder the data through the sequence number field.

[0108] In the embodiment of the present invention, the key-value pair refers to a method for storing and organizing data, and is mainly composed of a unique key and an associated value.

[0109] The embodiment of the present invention verifies the protocol sequence number fields of two traffic packets through a key-value pair, and performs a traffic packet merging operation according to the protocol sequence number fields.

[0110] Furthermore, after the merging is completed and the database traffic is obtained, the method further includes:

[0111] Pushing the database traffic to a memory ring queue of a preset size, and using an event work processor to receive the traffic packets stored in the memory ring queue;

[0112] After the event work processor receives the traffic packet stored in the memory ring queue, the event work processor decodes the traffic packet using a database decoder to obtain a decoded data entity;

[0113] The decoded data entity is sent to the transceiver unit according to the log message transmission protocol.

[0114] In an embodiment of the present invention, the memory circular queue is a data structure that can be pre-allocated in memory with a fixed size, and this memory can be used cyclically in a head-to-tail manner. When the tail of the queue reaches the end of the memory, new data will continue to be stored from the beginning of the memory, forming a loop.

[0115] In the embodiment of the present invention, the preset size of the memory ring queue can be set to a 1024*1024 memory ring queue.

[0116] Before the embodiment of the present invention uses a database decoder to decode the traffic packet to obtain a decoded data entity, it is necessary to configure a database decoding logic for determining the category of the traffic packet and performing database decoding.

[0117] In an embodiment of the present invention, the database decoding logic is as follows: ① Determine whether the number of readable bytes meets the specified length. If not, return directly; ② Determine whether the traffic packet is an authentication login packet. If it is an authentication packet, the sql type record is LOGIN, and the sql type is divided into 6 types: LOGIN, DML, DDL, DCL, TCL, and OTHER; ③ Decode the traffic packet; ④ Encapsulate the traffic packet into a data entity in a specified format.

[0118] The database traffic decoding module 102 is used to decode the operation statements in the database traffic to obtain database operation statements.

[0119] In the embodiment of the present invention, the operation statement refers to an SQL (Structured Query Language) statement formed by performing various operations on the data in the database. For example, the following statement "select * from city where city_code = '500112'" is an operation statement.

[0120] As an embodiment of the present invention, the decoding of the operation statement in the database traffic to obtain the database operation statement includes:

[0121] The transceiver unit starts the log message transmission protocol server to receive the decoded data entity, and sends the decoded data entity to the log message event processor;

[0122] The log message event processor extracts the entity object in the decoded data entity, and performs a decoding operation on the entity object using a preset data format to obtain a database event;

[0123] The database event is transmitted to a message queue according to a tag in the database event, and an operation statement in the database event is extracted to obtain the database operation statement.

[0124] In the embodiment of the present invention, the decoding entity includes but is not limited to data receiving time, data level value, data tag value, message body, etc.

[0125] Furthermore, before the transceiver unit starts the log message transmission protocol server to receive the decoded data entity, it also includes configuring a routing distribution strategy in the transceiver unit, the steps of which include:

[0126] The data subject of the decoded data entity is extracted, and a routing distribution strategy is configured using a message forwarding channel, a message forwarding protocol, a message forwarding address, and the data subject.

[0127] The threat analysis module 103 is used to convert the database operation statement into a database operation event, perform threat analysis on the database operation event to obtain a threat analysis result, and use a preset alarm method to issue an alarm for the threat analysis result.

[0128] In the embodiment of the present invention, the database operation event refers to the event generated by converting a database operation statement.

[0129] As an embodiment of the present invention, before performing threat analysis on the database operation event to obtain a threat analysis result, it also includes configuring a threat feature library, and the steps include:

[0130] Obtain the feature names, feature values, feature classifications and risk levels of different types of databases according to the database type;

[0131] A threat feature library is constructed according to the feature names, feature values, feature classifications, and risk levels corresponding to different types of databases.

[0132] As an embodiment of the present invention, it also includes configuring a filtering strategy for a database, the steps are as follows:

[0133] Step 1: Set the protection object for the database and extract the relevant information of the database protection object, including database name, database type, IP address, and port number;

[0134] Step 2: Configure a filtering strategy according to the database protection object, wherein the filtering strategy includes traffic filtering and event filtering. Traffic filtering includes whitelist filtering and blacklist filtering. The main configuration information of whitelist filtering includes application, client IP, database user, etc.; the main configuration information of event filtering includes application, client IP, database user, audit mode (filtering and auditing) and filtered SQL statement regular expression.

[0135] Further, the performing threat analysis on the database operation event to obtain a threat analysis result includes:

[0136] Obtaining a database filtering policy, and determining whether the database operation event is a whitelist filtering item according to the database filtering policy;

[0137] If the database operation event is a whitelist filtering item, determining that the database operation event is a normal operation event;

[0138] If the database operation event is not a whitelist filtering item, all operation statements in the database operation event are standardized and converted to obtain a standardized operation statement feature set;

[0139] The standardized operation statement feature set is matched with the threat feature library, and after successful matching, the threat data operation statement in the standardized operation statement feature set is identified, and the database operation event corresponding to the threat operation statement is extracted as the threat analysis result.

[0140] Exemplarily, in a preferred embodiment, for different types of database operation statements (addition, deletion, modification), the above-mentioned filtering strategy and threat feature library are modified and cached locally. Among them, the filtering strategy is used to filter whether certain events are to be identified, and the feature library provides feature data for the threat identification unit. Step 1, the threat identification unit receives the transceiver unit database event, first obtains the filtering strategy, determines whether it is blacklist and whitelist filtering, whitelist releases, blacklist matches according to the configuration information, after the blacklist hits, it matches in sequence according to the event filtering rule list, the database object meets the client IP and database user conditions, obtains the event filtering rule statement, matches according to the audit and filtering mode, and performs threat feature identification for those that are not matched in the audit mode and matched in the filtering mode. Step 2, extract the operation statement in the event, use the mark to convert it, and perform special processing on the statement at the same time. The main processing includes deleting the matched bracket pair, retaining the bracket that cannot be matched directly, and converting it into a mark; empty comments (comments containing only blank characters) can be deleted, but non-empty comments must be retained. Step 3: The processed operation statements are uniformly converted to uppercase. For example, the database operation statement select * from city where city_code = '500112' is converted to: SELECT STAR FROM TABLE WHERE COL EQ VAR. The statement is segmented according to the tag to obtain the vocabulary feature set. The variance threshold is used to select the top n features that are conducive to classification, and the text vector is constructed. The extracted text vector is compared with the threat features in the threat feature library to identify the threat risk.

[0141] In an embodiment of the present invention, the preset alarm method refers to a method of informing relevant personnel of the threat risk. For example, the preset alarm method includes but is not limited to email, text message, instant messaging tool and telephone to ensure that the threat risk information can be conveyed to relevant personnel quickly and accurately.

[0142] like Figure 4 FIG. 1 is a schematic diagram of the structure of an electronic device for implementing a database attack threat analysis method provided by an embodiment of the present invention.

[0143] The electronic device may include a processor 10, a memory 11, a communication bus 12, and a communication interface 13, and may also include a computer program stored in the memory 11 and executable on the processor 10, such as a database attack threat analysis method program.

[0144] In some embodiments, the processor 10 may be composed of an integrated circuit, for example, a single packaged integrated circuit, or a plurality of packaged integrated circuits with the same or different functions, including one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, and combinations of various control chips. The processor 10 is the control core (ControlUnit) of the electronic device, and uses various interfaces and lines to connect various components of the entire electronic device, and executes or executes programs or modules stored in the memory 11 (for example, executing a database attack threat analysis method program, etc.), and calls data stored in the memory 11 to execute various functions of the electronic device and process data.

[0145] The memory 11 includes at least one type of readable storage medium, and the readable storage medium includes a flash memory, a mobile hard disk, a multimedia card, a card-type memory (for example, an SD or DX memory, etc.), a magnetic memory, a disk, an optical disk, etc. In some embodiments, the memory 11 may be an internal storage unit of an electronic device, such as a mobile hard disk of the electronic device. In other embodiments, the memory 11 may also be an external storage device of an electronic device, such as a plug-in mobile hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the electronic device. Further, the memory 11 may also include both an internal storage unit of the electronic device and an external storage device. The memory 11 may not only be used to store application software and various types of data installed in the electronic device, such as the code of a database attack threat analysis method program, but may also be used to temporarily store data that has been output or is to be output.

[0146] The communication bus 12 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. The bus is configured to realize connection and communication between the memory 11 and at least one processor 10, etc.

[0147] The communication interface 13 is used for communication between the above-mentioned electronic device and other devices, including a network interface and a user interface. Optionally, the network interface may include a wired interface and / or a wireless interface (such as a WI-FI interface, a Bluetooth interface, etc.), which is generally used to establish a communication connection between the electronic device and other electronic devices. The user interface may be a display (Display), an input unit (such as a keyboard (Keyboard)), and optionally, the user interface may also be a standard wired interface, a wireless interface. Optionally, in some embodiments, the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, and an OLED (Organic Light-Emitting Diode, organic light-emitting diode) touch device, etc. Among them, the display may also be appropriately referred to as a display screen or a display unit, which is used to display information processed in the electronic device and to display a visual user interface.

[0148] Figure 4 Only an electronic device with components is shown, and those skilled in the art will understand that Figure 4 The structure shown does not constitute a limitation on the electronic device, and may include fewer or more components than shown in the figure, or combine certain components, or arrange the components differently.

[0149] For example, although not shown, the electronic device may also include a power source (such as a battery) for supplying power to each component. Preferably, the power source may be logically connected to the at least one processor 10 through a power management device, so that the power management device can realize functions such as charging management, discharging management, and power consumption management. The power source may also include one or more DC or AC power sources, recharging devices, power failure detection circuits, power converters or inverters, power status indicators, and other arbitrary components. The electronic device may also include a variety of sensors, Bluetooth modules, Wi-Fi modules, etc., which will not be repeated here.

[0150] It should be understood that the embodiment is for illustration only and the scope of the patent application is not limited to this structure.

[0151] The database attack threat analysis method program stored in the memory 11 of the electronic device is a combination of multiple instructions. When running in the processor 10, it can achieve:

[0152] Capture the database traffic of the network card according to the port list of the network card;

[0153] Decoding the operation statements in the database traffic to obtain database operation statements;

[0154] The database operation statement is converted into a database operation event, and a threat analysis is performed on the database operation event to obtain a threat analysis result, and an alarm is issued for the threat analysis result using a preset alarm method.

[0155] Specifically, the specific implementation method of the processor 10 for the above instructions can refer to the description of the relevant steps in the corresponding embodiment of the accompanying drawings, which will not be repeated here.

[0156] Furthermore, if the module / unit integrated in the electronic device 1 is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. The computer-readable storage medium can be volatile or non-volatile. For example, the computer-readable medium can include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a mobile hard disk, a magnetic disk, an optical disk, a computer memory, and a read-only memory (ROM).

[0157] The present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor of an electronic device, the computer program can implement:

[0158] Capture the database traffic of the network card according to the port list of the network card;

[0159] Decoding the operation statements in the database traffic to obtain database operation statements;

[0160] The database operation statement is converted into a database operation event, and a threat analysis is performed on the database operation event to obtain a threat analysis result, and an alarm is issued for the threat analysis result using a preset alarm method.

[0161] In the several embodiments provided by the present invention, it should be understood that the disclosed devices, apparatuses and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of the modules is only a logical function division, and there may be other division methods in actual implementation.

[0162] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0163] In addition, each functional module in each embodiment of the present invention may be integrated into one processing unit, each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of hardware plus software functional modules.

[0164] It is obvious to those skilled in the art that the present invention is not limited to the details of the above exemplary embodiments, and that the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present invention.

[0165] Therefore, no matter from which point of view, the embodiments should be regarded as illustrative and non-restrictive, and the scope of the present invention is limited by the appended claims rather than the above description, so it is intended that all changes falling within the meaning and scope of the equivalent elements of the claims are included in the present invention. Any attached figure mark in the claims should not be regarded as limiting the claims involved.

[0166] The blockchain referred to in this invention is a new application mode of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, encryption algorithm, etc. Blockchain is essentially a decentralized database, a string of data blocks generated by cryptographic methods. Each data block contains a batch of network transaction information, which is used to verify the validity of its information (anti-counterfeiting) and generate the next block. Blockchain can include the underlying blockchain platform, platform product service layer, and application service layer.

[0167] The embodiments of the present application can acquire and process relevant data based on artificial intelligence technology. Among them, artificial intelligence (AI) is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results.

[0168] In addition, it is clear that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. Multiple units or devices stated in the system claim can also be implemented by one unit or device through software or hardware. The words first, second, etc. are used to indicate names, and do not indicate any particular order.

[0169] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solution of the present invention can be modified or replaced by equivalents without departing from the spirit and scope of the technical solution of the present invention.

Claims

1. A database attack threat analysis method, characterized in that: The method comprises: Capture the database traffic of the network card according to the port list of the network card; Decoding the operation statements in the database traffic to obtain database operation statements; The database operation statement is converted into a database operation event, and a threat analysis is performed on the database operation event to obtain a threat analysis result, and an alarm is issued for the threat analysis result using a preset alarm method.

2. The database attack threat analysis method according to claim 1, characterized in that: The capturing of database traffic of the network card according to the port list of the network card includes: Installing a traffic sniffing unit in the server where the business system is located, and using the traffic sniffing unit to capture traffic packets; Compile the protocol sequence number field of the traffic packet into a first key, and compile the traffic packet into a first value corresponding to the protocol sequence number field and cache it locally to obtain a first key-value pair; When the next traffic packet is captured, the source IP value of the next traffic packet is used as the second key, and the protocol sequence number field corresponding to the next traffic packet is used as the second value to obtain a second key-value pair; The traffic packets are merged according to the first key-value pair and the second key-value pair, and database traffic is obtained after the merging is completed.

3. The database attack threat analysis method according to claim 2, characterized in that: After the merging is completed to obtain the database traffic, the following is further included: Pushing the database traffic to a memory ring queue of a preset size, and using an event work processor to receive the traffic packets stored in the memory ring queue; After the event work processor receives the traffic packet stored in the memory ring queue, the event work processor decodes the traffic packet using a database decoder to obtain a decoded data entity; The decoded data entity is sent to the transceiver unit according to the log message transmission protocol.

4. The database attack threat analysis method according to claim 3, characterized in that: The decoding of the operation statement in the database traffic to obtain the database operation statement includes: The transceiver unit starts the log message transmission protocol server to receive the decoded data entity, and sends the decoded data entity to the log message event processor; The log message event processor extracts the entity object in the decoded data entity, and performs a decoding operation on the entity object using a preset data format to obtain a database event; The database event is transmitted to a message queue according to a tag in the database event, and an operation statement in the database event is extracted to obtain the database operation statement.

5. The database attack threat analysis method according to claim 4, characterized in that: Before the transceiver unit starts the log message transmission protocol server to receive the decoded data entity, it also includes configuring a routing distribution strategy in the transceiver unit, and the steps include: The data subject of the decoded data entity is extracted, and a routing distribution strategy is configured using a message forwarding channel, a message forwarding protocol, a message forwarding address, and the data subject.

6. The database attack threat analysis method according to claim 1, characterized in that: Before performing threat analysis on the database operation event to obtain a threat analysis result, a threat feature library is configured, and the steps include: Obtain the feature names, feature values, feature classifications and corresponding risk levels of different types of databases according to the database type; A threat feature library is constructed according to the feature names, feature values, feature classifications and corresponding risk levels.

7. The database attack threat analysis method according to claim 6, characterized in that: The performing threat analysis on the database operation event to obtain a threat analysis result includes: Obtaining a database filtering policy, and determining whether the database operation event is a whitelist filtering item according to the database filtering policy; If the database operation event is a whitelist filtering item, determining that the database operation event is a normal operation event; If the database operation event is not a whitelist filtering item, all operation statements in the database operation event are standardized and converted to obtain a standardized operation statement feature set; The standardized operation statement feature set is matched with the threat feature library, and after successful matching, the threat data operation statement in the standardized operation statement feature set is identified, and the database operation event corresponding to the threat operation statement is extracted as the threat analysis result.

8. A database attack threat analysis device, characterized in that: The device can implement the database attack threat analysis method according to any one of claims 1 to 7, and the device includes: A database traffic acquisition module is used to capture the database traffic of the network card according to the port list of the network card; A database traffic decoding module, used for decoding operation statements in the database traffic to obtain database operation statements; The threat analysis module is used to convert the database operation statement into a database operation event, perform threat analysis on the database operation event to obtain a threat analysis result, and use a preset alarm method to warn the threat analysis result.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the database attack threat analysis method according to any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the database attack threat analysis method according to any one of claims 1 to 7 is implemented.

Images