Database security situation awareness method and system based on multilayer perceptron

Abstract

According to the database security situation awareness method and system based on the multi-layer perceptron, security scores and security situation evaluation are calculated for multiple data sources and multiple complex security indexes, data serve as feature input of a multi-layer perceptron model, and real-time security situation awareness of a database is achieved. Quantitative analysis of key indexes such as identity authentication and access control, data integrity and confidentiality, system vulnerability and patch management, logs and audit, database performance and the like is combined with refined risk grade division of high risk, medium-high risk, medium risk, medium-low risk and low risk; the technical problems that in the prior art, a safety index system is incomplete, and a risk assessment result is rough are solved, and the accuracy and pertinence of database safety assessment are comprehensively improved.

Description

Technical Field

[0001] The invention relates to a database security situation awareness method and system based on a multi-layer perceptron, and belongs to the field of database security. Background Art

[0002] As the core of the information system, the database carries a large amount of critical data. Database security is particularly important and is directly related to data integrity and reliability. However, with the increasing number of network attack methods, the threats and challenges faced by the database are also gradually increasing, from external network attacks, internal illegal access, data and system leaks and other problems. The database security situation awareness platform is a professional system for monitoring and evaluating the security status of the database. By collecting user access records, permission changes, data reading and writing and other operation data, it can detect abnormal behaviors and potential threats inside and outside the database in real time. The security situation awareness platform uses security rules and deep learning technology to achieve all-round database security monitoring and perception, including security scoring and risk assessment, to ensure the stable operation of the database system and reduce the impact of various unstable and unsafe factors on the security of the database system.

[0003] When facing database security threats, existing database security situation awareness platforms usually have the following problems:

[0004] (1) Incomplete security indicator system: Existing database security situation awareness platforms usually rely on a few simple indicators to evaluate the database security status, such as the number of unauthorized user access attempts and common log analysis. These simple and limited indicators are difficult to comprehensively reflect the database security status. Existing security situation awareness platforms lack comprehensive indicator considerations for multiple dimensions such as permission management, database integrity and confidentiality, system vulnerability and patch management, log and audit, and database performance. The existing simple indicator system will lead to one-sided evaluation results and low accuracy.

[0005] (2) Insufficient deeper analysis capabilities: Existing security situation awareness methods rely too much on rules and experience, and the deep mining and analysis of historical data in the database is not deep enough, making it difficult to deal with unknown threats and complex attacks. Existing security situation awareness platforms that introduce deep learning are limited by excessive model load and heavy reliance on data, resulting in high computing costs and insufficient generalization capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0006] Figure 1 It is the system flow chart. Summary of the invention

[0007] The present invention proposes a database security situation awareness method based on a multi-layer perceptron, which calculates security scores and security situation assessments for multiple data sources and multiple complex security indicators, and uses the data as feature input of the multi-layer perceptron model to achieve real-time security situation awareness of the database. The method includes the following steps:

[0008] (1) Database security scoring: quantify key security indicators and score database security;

[0009] (2) Database security situation assessment: Comprehensively evaluate the overall security situation of the database by combining various security indicators and classifying them into different risk levels;

[0010] (3) Security situation assessment: Use a multi-layer perceptron network to conduct security situation assessment.

[0011] Furthermore, in step (1), the database security score includes the following steps:

[0012] 1.1 Calculating Identity Authentication and Access Control Security Score Among them, U t is the number of unauthorized access attempts in hour t; W t is the time weighting factor of the tth hour; is the total time period; P j Score the authority of the jth user; I j Score the importance of the j-th user's permission; J is the total number of users.

[0013] 1.2 Calculating Data Integrity and Confidentiality Security Scores Among them, H k Score the severity of the kth data leakage event; Z k is the specific impact of k data leakage events; K is the total number of data leakage events; U d is the number of unencrypted sensitive data entries; T d is the total number of sensitive data entries.

[0014] 1.3 Calculating System Vulnerabilities and Patch Management Security Score Among them, V l R is the severity score of the lth vulnerability; l is the impact range of the lth vulnerability; L is the total number of vulnerabilities; D m is the delay time of the mth patch; Y m is the importance score of the mth patch; M is the total number of patches.

[0015] 1.4 Calculating logs and auditing security scores E n For the nth

[0016] The integrity score of the log; Gn is the importance score of the nth log; N is the total number of log entries; β is the number of audit log analyses.

[0017] 1.5 Calculating Database Performance Security Score Among them, A p is the score of the pth abnormal traffic event; S p is the severity score of the pth abnormal traffic event; P is the total number of abnormal traffic events; B q is the response time of the qth request; C q is the weighting factor of the qth request; Q is the total number of requests.

[0018] Based on the above method, the present invention proposes a database security situation awareness system based on a multi-layer perceptron, which calculates security scores and security situation assessments for multiple data sources and multiple complex security indicators, and uses the data as feature input of the multi-layer perceptron model to achieve real-time security situation awareness of the database. The system includes:

[0019] (1) Database security scoring module: This module quantifies key security indicators and scores database security;

[0020] (2) Database security situation assessment module: This module evaluates the overall security situation of the database by combining various security indicators and classifies it into different risk levels;

[0021] (3) Security situation assessment module: This module uses a multi-layer perceptron network to perform security situation assessment.

[0022] Furthermore, in the database security scoring module, the database security scoring includes the following steps:

[0023] 1.1 Calculating Identity Authentication and Access Control Security Score Among them, U t is the number of unauthorized access attempts in hour t; W t is the time weighting factor of the tth hour; is the total time period; P j Score the permissions of the jth user; I j Score the importance of the j-th user's permission; J is the total number of users.

[0024] 1.2 Calculating Data Integrity and Confidentiality Security Scores Among them, H k Score the severity of the kth data leakage event; Z k is the specific impact of k data leakage events; K is the total number of data leakage events; U d is the number of unencrypted sensitive data entries; T d is the total number of sensitive data entries.

[0025] 1.3 Calculating System Vulnerabilities and Patch Management Security Score Among them, V l R is the severity score of the lth vulnerability; l is the impact range of the lth vulnerability; L is the total number of vulnerabilities; D m is the delay time of the mth patch; Y m is the importance score of the mth patch; M is the total number of patches.

[0026] 1.4 Calculating logs and auditing security scores E n For the nth

[0027] The integrity score of the log; G n is the importance score of the nth log; N is the total number of log entries; β is the number of audit log analyses.

[0028] 1.5 Calculating Database Performance Security Score Among them, A p is the score of the pth abnormal traffic event; S p is the severity score of the pth abnormal traffic event; P is the total number of abnormal traffic events; B q is the response time of the qth request; C q is the weighting factor of the qth request; Q is the total number of requests.

[0029] The present invention solves the technical problems of incomplete security indicator system and rough risk assessment results in the prior art through quantitative analysis of key indicators such as identity authentication and access control, data integrity and confidentiality, system vulnerability and patch management, log and audit, database performance, etc., combined with refined risk level classification of high risk, medium-high risk, medium risk, medium-low risk, and low risk, thereby comprehensively improving the accuracy and pertinence of database security assessment. DETAILED DESCRIPTION

[0030] Example 1

[0031] The present invention proposes a database security situation awareness method based on a multi-layer perceptron, which calculates security scores for multiple data sources and multiple complex indicators, and uses the security scores as feature inputs of a multi-layer perceptron network model to achieve dynamic database security situation awareness. The method includes three parts: database security scoring, database security situation assessment, and multi-layer perceptron network. Figure 1 .

[0032] 1. Database security score

[0033] In the database security score section, the security score quantification of five indicators is mainly considered, namely identity authentication and access control, data integrity and confidentiality, system vulnerability and patch management, log and audit, and database performance.

[0034] Specifically, the quantitative rules for the security scores of the five databases are as follows:

[0035] (1) Identity Authentication and Access Control

[0036] In order to comprehensively evaluate the security of identity authentication and access control, this paper considers the number of unauthorized accesses and the effectiveness of permission allocation. The identity authentication and access control security score is calculated as follows:

[0037]

[0038] Among them, U t represents the number of unauthorized access attempts in the tth hour, which is used to measure the threat of illegal access; W t represents the time weighting factor of the tth hour, which is used to adjust the impact of unauthorized access in different time periods; T represents the total time period; P j represents the permission score of the jth user, indicating whether the permission setting of the user is safe; I j represents the importance score of the j-th user permission, which evaluates the impact of this permission on security; J represents the total number of users.

[0039] (2) Data integrity and confidentiality

[0040] The assessment of data integrity and confidentiality takes into account the severity of the data breach and the encryption of sensitive data. The severity of the data breach is balanced by normalization, and the encryption ratio reflects the effectiveness of data confidentiality. The data integrity and confidentiality security scores are as follows:

[0041]

[0042] Among them, H k represents the severity score of the kth data leakage event, measuring the impact of the leakage event on data integrity; Z k represents the specific impact of k data breach incidents, such as the scope or type of data breach; K represents the total number of data breach incidents, which is used to standardize the severity score of data breach incidents; U d Represents the number of unencrypted sensitive data entries, used to evaluate data confidentiality; T d Indicates the total number of sensitive data entries, used to calculate the proportion of unencrypted sensitive data.

[0043] (3) System vulnerability and patch management

[0044] The system vulnerability and patch management score takes into account the severity of the vulnerability and the timeliness of the patch. By applying the square root of the vulnerability severity and the exponential function to the patch delay, the effectiveness of vulnerability management and patch application can be more accurately reflected. The system vulnerability and patch management security score is as follows:

[0045]

[0046] Among them, V l Represents the severity score of the lth vulnerability, which evaluates the potential threat of the vulnerability to the system; R l represents the impact scope of the lth vulnerability, indicating the impact that the vulnerability may cause; L represents the total number of vulnerabilities, which is used to standardize the vulnerability severity score; D m represents the delay time of the mth patch, which measures the timeliness of patch application; Y m represents the importance score of the mth patch, indicating the contribution of the patch to the system security; M represents the total number of patches.

[0047] (4) Logging and Auditing

[0048] The log and audit scores are scored by comprehensively evaluating the integrity of log records and the analysis coverage of audit logs. By calculating the average integrity score and analysis coverage of log records, the effectiveness of log management can be fully reflected. The log and audit security scores are as follows:

[0049]

[0050] E n represents the integrity score of the nth log, which evaluates whether the log record is comprehensive; G n It represents the importance score of the nth log, indicating the value of the log to the audit; N represents the total number of log entries; β represents the number of audit log analyses, measuring the audit coverage.

[0051] (5) Database performance

[0052] The database performance score combines the severity of abnormal traffic events and the database response time. By taking the average value of abnormal traffic events and inversely processing the response time, a more comprehensive assessment of database performance can be made. The database performance security score is as follows:

[0053]

[0054] Among them, A p represents the score of the pth abnormal traffic event, which evaluates the impact of traffic anomaly on performance; S p represents the severity score of the pth abnormal traffic event, measuring its potential impact on the system; P represents the total number of abnormal traffic events; B qrepresents the response time of the qth request, which evaluates the response performance of the database; C q It represents the weighting factor of the qth request, which is used to adjust the impact of the response time of different requests; Q represents the total number of requests.

[0055] 2. Database security situation assessment

[0056] In the database security situation assessment part, the database security situation is assessed by comprehensively analyzing the data of various indicators. The process is as follows:

[0057] (1) Normalization: In order to eliminate the error of the index, each index is normalized to obtain the normalized index F x ′, represents the normalized index result of the xth index value in the system;

[0058] (2) Determine the corresponding weight ω of indicator x x ;

[0059] (3) Calculate the database security situation assessment value Where X is the number of indicators.

[0060] (4) The database security situation risk level is divided into five risk levels: low risk, medium-low risk, medium risk, medium-high risk and high risk.

[0061] 3. Security situation assessment

[0062] After completing the database security situation assessment, deep learning is used for training to obtain the database security situation risk level, thereby realizing the perception of the database security situation.

[0063] Specifically, the existing deep neural network model contains a large number of hidden layers and neurons, the computational cost is high, and the dependence on data is high, and the generalization ability is relatively weak. Secondly, the redundant parameters of the model will affect the redundant parameters of the model. Therefore, the present invention adopts a multi-layer perceptron network as a training model, and significantly reduces the amount of model parameters through pruning operations. Compared with the traditional deep neural network model, the pruned multi-layer perceptron network model can significantly reduce memory usage and storage requirements while maintaining performance. The pruned model is more lightweight and more conducive to deployment and maintenance in practical applications.

[0064] (1) Multilayer Perceptron Training Process

[0065] Given an input vector s, forward propagation is performed through the multilayer perceptron model to calculate the output in and Indicates The weight matrix and bias vector of the layer, Indicates The activation value of the layer;

[0066] Calculating the loss function in, is the sample size, and

[0067] are the predicted value and true value of the i-th sample respectively.

[0068] (2) Pruning optimization

[0069] According to the output contribution of the neuron, decide whether to remove the entire neuron. Layer of neurons (No. The activation value of each neuron) is used to calculate its contribution in, is the sample size, Indicates The neuron in The absolute activation value for each sample.

[0070] If the contribution of a neuron If the value is lower than the threshold θ, the neuron is removed and the corresponding weight matrix is ​​updated after pruning. and to remove the connections of the pruned neurons.

[0071] Example 2

[0072] 1. Database security score

[0073] (1) Identity Authentication and Access Control

[0074] Assume that within a one-month time frame, the database detects the following situations

[0075] Number of unauthorized accesses (per hour): U = [0, 3, 1, 5, 0, 0, 2, ..., 0]

[0076] Time weighting factor: W = [1, 0.8, 1, 0.6, 1, 1, 0.9, ..., 1]

[0077] Permission score and importance score: Assume there are 5 users, P = [0.9, 0.8, 1.0, 0.7, 0.95], I = [0.8, 0.9, 1.0, 0.7, 0.85]

[0078]

[0079] (2) Data integrity and confidentiality:

[0080] (3) System vulnerability and patch management:

[0081] (4) Logging and auditing:

[0082] (5) Database performance:

[0083] 2. Calculate the database security situation assessment value

[0084] Assume weights ω = [0.25, 0.25, 0.2, 0.15, 0.15]

[0085] Security posture assessment value:

[0086] Eval=0.314×0.25+0.55×0.25+0.47×0.2+0.503×0.15+0.19×0.15=0.4266

[0087] The risk levels are classified as follows:

[0088] High risk (0.8-1.0)

[0089] Medium to high risk (0.6-0.8)

[0090] Medium risk (0.4-0.6)

[0091] Low to medium risk (0.2-0.4)

[0092] Low risk (0.0-0.2)

[0093] According to the calculation results, the security situation assessment value of the database is 0.4266, which is a medium risk. Compared with traditional technologies that rely only on a single indicator or unclear risk categories, the present invention more accurately evaluates the overall security situation of the database by integrating scores from multiple dimensions. In addition, the clear division of risks enables database managers to identify potential risks in a timely manner. Compared with the fuzzy classification in the prior art, the risk level division of the present invention is more operational and practical. Finally, these data are used to train a deep model to monitor the security status of the database, prevent losses caused by database failures, and use deep learning to effectively realize database security situation awareness.

[0094] The units, devices or modules described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. For the convenience of description, the above devices are described separately by functions divided into various modules. Of course, when implementing this application, the functions of each module can be implemented in the same or more software and / or hardware, or the modules that implement the same function can be implemented by a combination of multiple sub-modules or sub-units. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the coupling or direct coupling or communication connection between each other shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0095] Those skilled in the art also know that, in addition to implementing the controller in a purely computer-readable program code, the controller can be made to implement the same function in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, such a controller can be considered as a hardware component, and the devices for implementing various functions included therein can also be considered as structures within the hardware component. Or even, the devices for implementing various functions can be considered as both software modules for implementing the method and structures within the hardware component.

[0096] The present application may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, classes, etc. that perform specific tasks or implement specific abstract data types. The present application may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0097] It can be known from the description of the above implementation methods that those skilled in the art can clearly understand that the present application can be implemented by means of software plus a necessary general hardware platform. Based on such an understanding, the technical solution of the present application can be essentially or partly contributed to the prior art in the form of a software product, which can be stored in a storage medium such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes several instructions for enabling a computer device (which can be a personal computer, a mobile terminal, a server, or a network device, etc.) to execute the methods described in the various embodiments of the present application or certain parts of the embodiments.

[0098] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld devices or portable devices, tablet devices, multi-processor systems, microprocessor-based systems, set-top boxes, programmable electronic devices, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc.

[0099] The specific embodiments described above further illustrate the purpose, technical solutions and beneficial effects of the present application. It should be understood that the above description is only a specific embodiment of the present application and is not intended to limit the scope of protection of the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application.

Claims

1. A database security situation awareness method based on a multi-layer perceptron calculates security scores and security situation assessments for multiple data sources and multiple complex security indicators, and uses the data as feature input of a multi-layer perceptron model to achieve real-time security situation awareness of the database, characterized by: The method comprises the following steps: (1) Database security scoring: quantify key security indicators and score database security; (2) Database security situation assessment: Comprehensively evaluate the overall security situation of the database by combining various security indicators and classifying them into different risk levels; (3) Security situation assessment: Use a multi-layer perceptron network to conduct security situation assessment.

2. The method for database security situation awareness based on a multi-layer perceptron as claimed in claim 1, characterized in that: In step (1), the database security score includes: 1.1 Calculating Identity Authentication and Access Control Security Score Among them, U t is the number of unauthorized access attempts in hour t; W t is the time weighting factor of the tth hour; is the total time period; P j Score the permissions of the jth user; I j Score the importance of the j-th user's permission; J is the total number of users. 1.2 Calculating Data Integrity and Confidentiality Security Scores Among them, H k Score the severity of the kth data leakage event; Z k is the specific impact of k data leakage events; K is the total number of data leakage events; U d is the number of unencrypted sensitive data entries; T d is the total number of sensitive data entries. 1.3 Calculating System Vulnerabilities and Patch Management Security Score Among them, V l R is the severity score of the lth vulnerability; l is the impact range of the lth vulnerability; L is the total number of vulnerabilities; D m is the delay time of the mth patch; Y m is the importance score of the mth patch; M is the total number of patches. 1.4 Calculating logs and auditing security scores Where E n G is the integrity score of the nth log; n is the importance score of the nth log; N is the total number of log entries; β is the number of audit log analyses. 1.5 Calculating Database Performance Security Score Among them, A p is the score of the pth abnormal traffic event; S p is the severity score of the pth abnormal traffic event; P is the total number of abnormal traffic events; B q is the response time of the qth request; C q is the weighting factor of the qth request; Q is the total number of requests.

3. A database security situation awareness system based on a multi-layer perceptron, which calculates security scores and security situation assessments for multiple data sources and multiple complex security indicators, and uses the data as feature input of a multi-layer perceptron model to achieve real-time security situation awareness of the database, characterized by: The system includes: (1) Database security scoring module: This module quantifies key security indicators and scores database security; (2) Database security situation assessment module: This module evaluates the overall security situation of the database by combining various security indicators and classifies it into different risk levels; (3) Security situation assessment module: This module uses a multi-layer perceptron network to perform security situation assessment.

4. A database security situation awareness system based on a multi-layer perceptron as claimed in claim 3, characterized in that: In the database security scoring module, the database security score includes: 1.1 Calculating Identity Authentication and Access Control Security Score Among them, U t is the number of unauthorized access attempts in hour t; W t is the time weighting factor of the tth hour; is the total time period; P j Score the permissions of the jth user; I j Score the importance of the j-th user's permission; J is the total number of users. 1.2 Calculating Data Integrity and Confidentiality Security Scores in, H k Score the severity of the kth data leakage event; Z k is the specific impact of k data leakage events; K is the total number of data leakage events; U d is the number of unencrypted sensitive data entries; T d is the total number of sensitive data entries. 1.3 Calculating System Vulnerabilities and Patch Management Security Score in, V l R is the severity score of the lth vulnerability; l is the impact range of the lth vulnerability; L is the total number of vulnerabilities; D m is the delay time of the mth patch; Y m is the importance score of the mth patch; M is the total number of patches. 1.4 Calculating logs and auditing security scores Where E n G is the integrity score of the nth log; n is the importance score of the nth log; N is the total number of log entries; β is the number of audit log analyses. 1.5 Calculating Database Performance Security Score in, A p is the score of the pth abnormal traffic event; S p is the severity score of the pth abnormal traffic event; P is the total number of abnormal traffic events; B q is the response time of the qth request; C q is the weighting factor of the qth request; Q is the total number of requests.

Images