Association relation and audit log generation method, electronic equipment, storage medium and program product

Abstract

The invention relates to the technical field of data security, and discloses an association relationship and audit log generation method, electronic equipment, a storage medium and a program product. The method comprises the following steps: acquiring a first audit event and webpage operation information of the first audit event; determining a basic time period corresponding to the first audit event according to the occurrence time of the first audit event and the event estimation duration; according to the basic time period of the first audit event, obtaining alternative database events corresponding to the webpage operation information of the first audit event and the occurrence frequency of the alternative database events from a database log; and determining a target database event corresponding to the webpage operation information from the alternative database events corresponding to the webpage operation information according to the occurrence frequency of the alternative database events corresponding to the webpage operation information, and recording a first association relationship between the webpage operation information and the target database event. In this way, the association between the operation information of the database and the specific operation information of the client can be determined.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and in particular to an association relationship and audit log generation method, electronic equipment, storage medium, and program product. Background Art

[0002] Database auditing is the process of tracking, recording, and analyzing activities in a database system to ensure the compliance, security, and integrity of database operations. Database auditing can help organizations monitor and review access to and operations on databases to prevent and detect security issues such as unauthorized data access, data leakage, and data tampering.

[0003] Database auditing usually generates audit logs that record all critical database activities, including user logins, query executions, data changes, etc. These logs need to be stored securely and can be retrieved and analyzed.

[0004] However, the current database audit log can only reflect the operation information on the database, and it is difficult to associate the operation information on the database with the specific operation information of the user on the client.

[0005] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present application, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0006] In order to provide a basic understanding of some aspects of the disclosed embodiments, a brief summary is given below. The summary is not an extensive review, nor is it intended to identify key / critical components or delineate the scope of protection of these embodiments, but rather serves as a prelude to the detailed description that follows.

[0007] The embodiments of the present application provide a method for generating an association relationship and an audit log, an electronic device, a storage medium, and a program product, so that the operation information of the database and the specific operation information of the user on the client can be associated in the audit log.

[0008] In a first aspect, an embodiment of the present application provides a method for generating an association relationship, including: obtaining a first audit event and webpage operation information of the first audit event;

[0009] Determine a basic time period corresponding to the first audit event according to the occurrence time of the first audit event and the preset estimated duration of the event; the basic time period represents the time period during which the database event triggered by the first audit event lasts;

[0010] According to the basic time period of the first audit event, obtaining from the database log the candidate database event corresponding to the webpage operation information of the first audit event and the number of occurrences of the candidate database event;

[0011] According to the number of occurrences of the alternative database event corresponding to the web page operation information, the target database event corresponding to the web page operation information is determined from the alternative database events corresponding to the web page operation information, and a first association relationship between the web page operation information and the target database event is recorded; wherein, when generating an audit log of the target database event, the first association relationship is used to determine the web page operation information corresponding to the target database event through the first association relationship, so that the audit log of the target database event includes the web page operation information of the target database event.

[0012] After the audit event is generated, a series of database events may be triggered. Therefore, in the above implementation scheme, by using the occurrence time of the first audit event and the estimated duration of the event, that is, the estimated duration of the database event triggered by the first audit event, the time period in which the database event triggered by the first audit event will exist is estimated, that is, the basic time period corresponding to the first audit event. Then, according to the basic time period of the first audit event, the candidate database event corresponding to the web page operation information of the first audit event and the number of occurrences of the candidate database event are obtained from the database log. Since the basic time period of the first audit event is the estimated time period in which the database event triggered by the first audit event will exist. Therefore, according to the basic time period, the candidate database event obtained from the database log is most likely to be a database event triggered by the first audit event. Finally, according to the number of occurrences of the candidate database event corresponding to the web page operation information, the target database event corresponding to the web page operation information is determined from the candidate database event corresponding to the web page operation information. In this way, the correlation between the candidate database event and the web page operation information can be determined according to the number of occurrences of the candidate database event, and then the target database event corresponding to the web page operation information can be determined. Finally, the first association relationship between the webpage operation information and the target database event is recorded. In order to facilitate the subsequent generation of an audit log of the target database event, the webpage operation information corresponding to the target database event can be determined through the first association relationship, so that the audit log of the target database event includes the webpage operation information of the target database event, and the database operation information and the specific operation information of the client are associated in the audit log.

[0013] Further, according to the occurrence time of the first audit event and the preset estimated duration of the event, determining the basic time period corresponding to the first audit event includes:

[0014] Calculate the sum of the occurrence time of the first audit event and the estimated duration of the event to obtain a first time;

[0015] The basic time period is a time period starting from the occurrence time of the first audit event and ending at the first time.

[0016] In the above implementation scheme, the end time of the basic time period can be obtained by calculating the sum of the occurrence time of the first audit event and the estimated duration of the event. At the same time, the occurrence time of the first audit event is used as the start time of the basic time period. In this way, the basic time period corresponding to the first audit event can be determined.

[0017] Further, according to the occurrence time of the first audit event and the preset estimated duration of the event, determining the basic time period corresponding to the first audit event includes:

[0018] Calculate the sum of the occurrence time of the first audit event and the preset delay time to obtain a second time;

[0019] Calculate the sum of the occurrence time of the first audit event, the estimated duration of the event, and the delay duration to obtain a third time;

[0020] The basic time period is a time period starting from the second time and ending at the third time.

[0021] In the above implementation scheme, the start time of the basic time period is obtained by calculating the sum of the occurrence time of the first audit event and the preset delay duration. The end time of the basic time period is obtained by calculating the sum of the occurrence time of the first audit event, the estimated duration of the event and the delay duration. Due to the influence of factors such as network bandwidth, after the audit event occurs, the database event triggered by the audit event may be delayed for a certain period of time. The basic time period is determined by the occurrence time of the first audit event and the delay duration. In this way, even if the database event triggered by the audit event is delayed for a certain period of time, it can be compensated by the delay duration, so that the alternative database event of the first audit event can be obtained more accurately according to the basic time period in the future.

[0022] Furthermore, according to the basic time period of the first audit event, obtaining a candidate database event corresponding to the webpage operation information of the first audit event from the database log includes:

[0023] When the current time reaches the start time of the basic time period, a newly added database event is obtained from the database log, and the newly added database event is determined as a candidate database event corresponding to the webpage operation information of the first audit event;

[0024] When the current time reaches the end time of the basic time period, the acquisition of newly added database events from the database log is stopped.

[0025] Since the basic time period is the estimated time period during which the database event triggered by the first audit event will exist, in the above implementation, by obtaining newly added database events from the database log when the current time reaches the start time of the basic time period, and stopping obtaining newly added database events from the database log when the current time reaches the end time of the basic time period, the possibility of screening out the database event triggered by the first audit event from the numerous database events in the database log can be increased.

[0026] Furthermore, after acquiring the newly added database event from the database log, the method further includes:

[0027] If the second audit event is obtained before the end time of the basic time period arrives, then the acquisition of new database events from the database log is stopped.

[0028] In the above implementation, when the second audit event is obtained before the end time of the basic time period arrives, the acquisition of new database events from the database log is stopped. Since the second audit event may trigger the generation of new database events when the second audit event is generated, when the second audit event is obtained, the acquisition of new database events from the database log is stopped, which can not only reduce the number of database events obtained, but also avoid mistaking the database event triggered by the second audit event for the database event triggered by the first audit event.

[0029] Furthermore, after acquiring the newly added database event from the database log, the method further includes:

[0030] If the second audit event is acquired before the end time of the basic time period arrives, the end time of the basic time period is updated to the current time.

[0031] In the above implementation, when the second audit event is obtained before the end time of the basic time period arrives, the end time of the basic time period is updated to the current time. Since the second audit event may trigger the generation of a new database event when the second audit event is generated, the end time of the basic time period is updated to the current time when the second audit event is obtained. In this way, when the second audit event is obtained, the acquisition of new database events from the database can be stopped, thereby reducing the number of database events obtained and avoiding the database event triggered by the second audit event being mistakenly regarded as the database event triggered by the first audit event.

[0032] Furthermore, according to the basic time period of the first audit event, obtaining a candidate database event corresponding to the webpage operation information of the first audit event from the database log includes:

[0033] In the database log, a preset number of database events whose occurrence time is within the basic time period are selected as candidate database events corresponding to the webpage operation information of the first audit event.

[0034] In the above implementation scheme, a preset number of database events whose occurrence time is within the basic time period are selected from the database log as candidate database events corresponding to the webpage operation information of the first audit event. Since the basic time period represents the time period in which the database event triggered by the first audit event exists, and there may be many database events within the basic time period, selecting a preset number of database events can reduce the number of database events that need to be analyzed, so that the number of occurrences of the candidate database events corresponding to the webpage operation information can be counted more quickly in the subsequent period.

[0035] Further, according to the number of occurrences of the candidate database events corresponding to the webpage operation information, determining the target database event corresponding to the webpage operation information from the candidate database events corresponding to the webpage operation information includes:

[0036] When the number of occurrences of the candidate database event corresponding to the webpage operation information satisfies a first preset condition, determining the candidate database event corresponding to the webpage operation information as the target database event corresponding to the webpage operation information;

[0037] Among them, the first preset condition includes at least one of the following: the number of occurrences is greater than or equal to a first preset threshold; the number of occurrences is within a preset number ranking.

[0038] In the above implementation scheme, by using an alternative database event whose occurrence number is greater than or equal to a first preset threshold; and / or whose occurrence number is within the preset number ranking as the target database event corresponding to the web page operation information, the alternative database event with a relatively high correlation with the web page operation information can be used as the target database event corresponding to the web page operation information.

[0039] Furthermore, there are multiple first audit events; when the number of occurrences of the candidate database event corresponding to the webpage operation information meets a first preset condition, the candidate database event corresponding to the webpage operation information is determined as the target database event corresponding to the webpage operation information, and after recording the first association relationship between the webpage operation information and the target database event, the method further includes:

[0040] Determine whether there is identical web page operation information with the same content among the web page operation information;

[0041] The first association relationship of each of the same web page operation information is merged.

[0042] In the above implementation, when there are multiple first audit events, there may be first audit events including web page operation information with the same content. In this way, there will be multiple first association relationships for web page operation information with the same content, and by merging the first association relationships of the same web page operation information, the storage space occupied by the first association relationships can be reduced.

[0043] Furthermore, merging the first association relationship of each of the same web page operation information includes:

[0044] The content of each of the same web page operation information and the first target database event are associated and saved to obtain a second association relationship; the first target database event includes all different target database events recorded in the first association relationship of each of the same web page operation information.

[0045] In the above implementation, the second association relationship is obtained by associating and saving the content of each identical web page operation information and the first target database event. Since the first target database event includes all different target database events recorded in the first association relationship of each identical web page operation information, the second association relationship thus obtained can include all different target database events corresponding to the web page operation information, thereby avoiding repeated storage of target database events with the same content.

[0046] Furthermore, after associating and saving the content of each of the same webpage operation information and the first target database event to obtain the second association relationship, the method further includes:

[0047] For each webpage operation information, if there are multiple first target database events corresponding to the webpage operation information, first to-be-confirmed information is pushed; the first to-be-confirmed information includes multiple first target database events corresponding to the webpage operation information;

[0048] Receive first feedback information of the first information to be confirmed; the first feedback information includes a specified target database event; the specified target database event is one of a plurality of first target database events corresponding to the webpage operation information;

[0049] The first target database event except the designated target database event is deleted from the second association relationship corresponding to the webpage operation information.

[0050] Since the second association relationship corresponding to the webpage operation information may include multiple first target database events, in order to determine the first target database event with which the webpage operation information actually has an association relationship among multiple first target database events, in the above implementation scheme, by pushing the first information to be confirmed and receiving the first feedback information including the specified target database event, the first target database events other than the specified target database event are deleted from the second association relationship corresponding to the webpage operation information. In this way, the second association relationship corresponding to the webpage operation information only includes the specified target database event, achieving the effect of determining the first target database event with which the webpage operation information actually has an association relationship among multiple first target database events.

[0051] Furthermore, there are multiple first audit events; before obtaining, from a database log, a candidate database event corresponding to the webpage operation information of the first audit event and the number of occurrences of the candidate database event according to a basic time period of the first audit event, the method further includes:

[0052] Merge all web page operation information with the same content into one web page operation information;

[0053] Correspondingly, according to the basic time period of the first audit event, obtaining the candidate database event corresponding to the webpage operation information of the first audit event and the number of occurrences of the candidate database event from the database log includes:

[0054] For each web page operation information, the candidate database event corresponding to the web page operation information and the number of occurrences of the candidate database event are obtained from the database log according to the basic time period of each first audit event having the web page operation information.

[0055] Since there are multiple first audit events, there may be first audit events including web page operation information with the same content. However, each first audit event, even if it includes web page operation information with the same content, may have different corresponding alternative database events. In order to be able to count the alternative database events corresponding to web page operation information with the same content in different basic time periods, in the above implementation scheme, all web page operation information with the same content is merged into one web page operation information, and then for each web page operation information, the alternative database event corresponding to the web page operation information and the number of occurrences of the alternative database event are obtained from the database log according to the basic time period of each first audit event with the web page operation information, so that the alternative database events corresponding to the web page operation information with the same content in different basic time periods and the number of occurrences of the alternative database event can be counted.

[0056] Further, according to the number of occurrences of the candidate database events corresponding to the webpage operation information, determining the target database event corresponding to the webpage operation information from the candidate database events corresponding to the webpage operation information includes:

[0057] For each webpage operation information, if the number of occurrences of the candidate database event corresponding to the webpage operation information meets the second preset condition, then push the second to-be-confirmed information, where the second to-be-confirmed information includes the candidate database event;

[0058] receiving second feedback information of the second information to be confirmed;

[0059] In a case where the second feedback information indicates that there is a first association relationship between the candidate database event and the webpage operation information, determining the candidate database event as the target database event corresponding to the webpage operation information;

[0060] Among them, the second preset condition includes at least one of the following: the number of occurrences is greater than or equal to a second preset threshold; the number of occurrences is within the preset number ranking.

[0061] In the above implementation scheme, after merging web page operation information with the same content, the corresponding candidate database event and the number of occurrences of the candidate database event are obtained for each operation information, and then the second information to be confirmed is pushed when the number of occurrences of the candidate database event corresponding to the web page operation information meets the second preset condition. Since there may be multiple candidate database events corresponding to the web page operation information, by determining that the number of occurrences of the candidate database event meets the second preset condition, the candidate database event with a greater correlation with the web page operation information can be pushed, so as to more quickly determine the target database event corresponding to the web page operation information from the multiple candidate database events. Finally, the second feedback information of the second information to be confirmed is received, and when the second feedback information indicates that there is a first correlation between the candidate database event and the web page operation information, the candidate database event is determined as the target database event corresponding to the web page operation information, so that the target database event can be determined more accurately and quickly from the multiple candidate database events corresponding to the web page operation information.

[0062] Furthermore, the association relationship generation method further includes:

[0063] In the case where all the second feedback information indicates that there is no first association relationship between the candidate database event and the webpage operation information, the preset number is increased; the preset number represents the number of candidate database events corresponding to the webpage operation information of the first audit event expected to be obtained from the database log;

[0064] Correspondingly, according to the basic time period of the first audit event, obtaining the candidate database event corresponding to the webpage operation information of the first audit event from the database log includes:

[0065] In the database log, according to the increased preset number, database events whose occurrence time is within the basic time period are selected as candidate database events corresponding to the webpage operation information of the first audit event.

[0066] In the above implementation scheme, when all the second feedback information indicates that there is no first association relationship between the alternative database event and the web page operation information, the preset number is increased. Since the preset number represents the number of alternative database events corresponding to the first audit event expected to be obtained from the database log. Therefore, when all the second feedback information indicates that there is no first association relationship between the alternative database event and the web page operation information, it can be determined that no database event with an actual association relationship with the web page operation information of the first audit event has been obtained in the database log, and by increasing the preset number, the range of quantity acquisition can be expanded. Finally, in the database log, according to the increased preset number, the database event whose occurrence time is within the basic time period is selected as the alternative database event corresponding to the web page operation information of the first audit event, so that the database event with an actual association relationship with the web page operation information of the first audit event can be obtained from the database log.

[0067] Furthermore, obtaining a first audit event includes:

[0068] Get alternative audit events;

[0069] If the candidate audit event includes a uniform resource identifier, the candidate audit event is determined to be the first audit event.

[0070] In the above implementation scheme, when the alternative audit event includes a uniform resource identifier, the alternative audit event is determined to be the first audit event. Since when the alternative audit event does not include a uniform resource identifier, the occurrence of this type of alternative audit event usually does not interact with the database. When the alternative audit event includes a uniform resource identifier, the alternative audit event also records the resource path and query parameters that the user attempts to access. That is, the occurrence of this type of alternative database event usually interacts with the database. Therefore, the alternative audit event including the uniform resource identifier is determined as the first audit event, and the first audit event that may interact with the database can be screened out from the alternative audit events, so as to facilitate the subsequent establishment of an association relationship between the web page operation information and the target database event.

[0071] Furthermore, the web page operation information of the first audit event includes a uniform resource identifier in the first audit event.

[0072] In a second aspect, an embodiment of the present application provides an audit log generation method, including:

[0073] In the case of receiving a database event, determining the webpage operation information corresponding to the database event according to a preset first association relationship between the webpage operation information and the target database event, wherein the preset first association relationship between the webpage operation information and the target database event is generated by the association relationship generation method described in the first aspect;

[0074] An audit log corresponding to the database event is generated using the database event and the webpage operation information corresponding to the database event.

[0075] In the above implementation scheme, when a database event is received, the webpage operation information corresponding to the database event is determined according to the first association relationship between the preset webpage operation information and the target database event, and then the audit log corresponding to the database event is generated using the database event and the webpage operation information corresponding to the database event. In this way, the audit log includes not only the database event but also the webpage operation information corresponding to the database event. In this way, the user can know the operation information of the database through the database event in the audit log, and can also know the specific client, or even the specific operation information of the client, through the webpage operation information corresponding to the database event in the audit log.

[0076] Furthermore, before generating an audit log corresponding to the database event using the database event and the webpage operation information corresponding to the database event, the method further includes:

[0077] Acquire the audit event corresponding to the database event according to the occurrence time of the database event and the webpage operation information corresponding to the database event;

[0078] Correspondingly, generating an audit log corresponding to the database event using the database event and the webpage operation information corresponding to the database event includes:

[0079] An audit log corresponding to the database event is generated using the database event and the audit event corresponding to the database event.

[0080] In the above implementation scheme, the audit event corresponding to the database event is obtained according to the occurrence time of the database event and the webpage operation information corresponding to the database event, and then the audit log corresponding to the database event is generated using the database event and the audit event corresponding to the database event. In this way, the audit log also includes the audit event corresponding to the database event. Since the audit event includes the user identifier, the access operation of a specific user to the database can be understood through the audit log.

[0081] In a third aspect, an embodiment of the present application provides an electronic device, including a processor and a memory, wherein the memory stores computer-executable instructions that can be executed by the processor, and the processor executes the computer-executable instructions to implement the above-mentioned association relationship generation method or audit log generation method.

[0082] In a fourth aspect, an embodiment of the present application provides a storage medium, which stores computer-executable instructions. When the computer-executable instructions are called and executed by a processor, the computer-executable instructions enable the processor to implement the above-mentioned association relationship generation method or audit log generation method.

[0083] In a fifth aspect, an embodiment of the present application provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements the above-mentioned association relationship generation method or audit log generation method.

[0084] The above general description and the following description are exemplary and explanatory only and are not intended to limit the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0085] One or more embodiments are exemplarily described by corresponding drawings, and these exemplary descriptions and drawings do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings are considered similar elements, and the drawings do not constitute a scale limitation, and wherein:

[0086] Figure 1 It is a network communication topology diagram provided by an embodiment of the present application;

[0087] Figure 2 It is a flowchart of a method for generating an association relationship provided in an embodiment of the present application;

[0088] Figure 3 is a flowchart of another association relationship generation method provided in an embodiment of the present application;

[0089] Figure 4 is a flowchart of another association relationship generation method provided in an embodiment of the present application;

[0090] Figure 5It is a flowchart of an audit log generation method provided by an embodiment of the present application;

[0091] Figure 6 It is a structural schematic diagram of an association relationship generating device provided in an embodiment of the present application;

[0092] Figure 7 It is a structural schematic diagram of an audit log generating device provided in an embodiment of the present application;

[0093] Figure 8 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0094] In order to be able to understand the features and technical contents of the embodiments of the present application in more detail, the implementation of the embodiments of the present application is described in detail below in conjunction with the accompanying drawings. The attached drawings are for reference only and are not used to limit the embodiments of the present application. In the following technical description, for the convenience of explanation, a full understanding of the disclosed embodiments is provided through multiple details. However, one or more embodiments can still be implemented without these details. In other cases, to simplify the drawings, well-known structures and devices can be simplified for display.

[0095] The terms "first", "second", etc. in the specification and claims of the embodiments of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the embodiments of the present application described here. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions.

[0096] Unless otherwise stated, the term "plurality" means two or more.

[0097] The term "correspondence" may refer to an association relationship or a binding relationship. The correspondence between A and B means that there is an association relationship or a binding relationship between A and B.

[0098] Combination Figure 1 As shown in the network communication topology diagram, during the database access process, the user can initiate a database access request to the Web service 102 through the application on the terminal device 101. After receiving the database access request, the Web service will interact with the database according to the database access request, thereby obtaining the data information corresponding to the database access request and feeding the data information back to the terminal device. The terminal device is, for example, a PC (Personal Computer).

[0099] In this process, data transmission and interaction are performed between the PC and the Web service via the HTTP (Hypertext Transfer Protocol). Data transmission and interaction are performed between the Web service 102 and the database via the database protocol. In addition, the Web service 102 can directly interact with the database using SQL statements. The Web service 102 can also indirectly access the database via the database service 103. The database service 103 is, for example, an intermediate layer or an API gateway.

[0100] When the Web service 102 interacts with the database, a database event is generated. For example, when the Web service 102 is connected to the database service 103, a connection establishment event is generated. However, the generation of database events can be triggered not only by Web services, but also by changes that occur automatically in the database.

[0101] In order to understand the association between the user's operation information on the client and the operation information of the database, so as to ensure the compliance, security and integrity of the database operation. The present application provides a method for generating an association relationship, by establishing an association relationship between web page operation information and database events, so that when the audit log of the database event is subsequently generated, the web page operation information corresponding to the database event can be determined through the established association relationship, so that the audit log of the database event includes the web page operation information of the database event. Then, the association between the operation information of the client and the operation information of the database can be understood through the audit log.

[0102] Embodiment 1

[0103] The present application provides a method for generating an association relationship. Figure 2 As shown, Figure 2 The flowchart of the association relationship generation method provided in the embodiment of the present application includes:

[0104] Step S201, obtaining a first audit event and web page operation information of the first audit event.

[0105] Specifically, alternative audit events can be obtained; if the alternative audit event includes a uniform resource identifier, the alternative audit event is determined to be the first audit event. In the case where the uniform resource identifier is not included in the alternative audit event, the occurrence of this type of alternative audit event usually does not interact with the database. In the case where the uniform resource identifier is included in the alternative audit event, the alternative audit event also records the resource path and query parameters that the user attempts to access. That is, the occurrence of this type of alternative database event usually involves data interaction with the database. Therefore, the alternative audit event including the uniform resource identifier is determined to be the first audit event, and the first audit event that may interact with the database can be screened out from the alternative audit events, so as to facilitate the subsequent establishment of an association relationship between the web page operation information and the target database event.

[0106] The candidate audit events may be obtained from the client log. Here, there is no limit on the number of candidate audit events. One candidate audit event may be obtained, or multiple candidate audit events may be obtained.

[0107] Furthermore, when multiple candidate audit events are obtained, the multiple candidate audit events may be obtained at the same time. Correspondingly, multiple existing candidate audit events are obtained from the client log.

[0108] It is also possible to obtain the newly added candidate audit event from the client log each time a candidate audit event is added to the client log, thereby obtaining multiple candidate audit events.

[0109] In addition, the number of first audit events is not limited here either, and one first audit event or multiple first audit events may be obtained.

[0110] The webpage operation information of the first audit event may be a uniform resource locator in the first audit event. The uniform resource locator may include an anchor. When the uniform resource locator includes an anchor, the specific location of the corresponding webpage may be located through the uniform resource locator. When the uniform resource locator does not include an anchor, only the corresponding webpage may be located through the uniform resource locator.

[0111] The web page operation information of the first audit event may also be the web page information corresponding to the uniform resource locator in the first audit event. The web page information may be a specific web page address or a page image of the web page. The page image may include the entire page of the web page or only a part of the entire web page.

[0112] Step S202, determining a basic time period corresponding to the first audit event according to the occurrence time of the first audit event and the preset estimated duration of the event; the basic time period represents the time period during which the database event triggered by the first audit event lasts.

[0113] In an optional implementation of the embodiment of the present application, the basic time period may be a time period starting from the occurrence time of the first audit event and ending at the first time, wherein the first time is the sum of the occurrence time of the first audit event and the estimated duration of the event.

[0114] In another optional implementation of the embodiment of the present application, the basic time period may be a time period starting at the second time and ending at the third time, wherein the second time is the sum of the occurrence time of the first audit event and the preset delay time, and the third time is the sum of the occurrence time of the first audit event, the estimated duration of the event, and the delay time.

[0115] The delay duration can be equal to the estimated duration of the event, or longer or shorter than the estimated duration of the event.

[0116] In another optional implementation of the embodiment of the present application, the delay duration is shorter than the estimated duration of the event, and the basic time period can also be a time period starting at the second time and ending at the first time. The second time is the sum of the occurrence time of the first audit event and the preset delay duration, and the first time is the sum of the occurrence time of the first audit event and the estimated duration of the event.

[0117] Step S203: According to the basic time period of the first audit event, the candidate database event corresponding to the webpage operation information of the first audit event and the number of occurrences of the candidate database event are obtained from the database log.

[0118] Specifically, a preset number of database events whose occurrence time is within a basic time period may be selected from the database log as candidate database events corresponding to the webpage operation information of the first audit event.

[0119] In an optional implementation method of the embodiment of the present application, all database events whose occurrence time is within the basic time period can be sorted in order from the previous to the next, and the database events ranked in the front of a preset number are used as candidate database events corresponding to the web page operation information of the first audit event.

[0120] In another optional implementation method of the embodiment of the present application, all database events whose occurrence time is within the basic time period can be sorted in order from the last occurrence time, and the database events that are sorted at the back of a preset number are used as candidate database events corresponding to the web page operation information of the first audit event.

[0121] In another optional implementation of the embodiment of the present application, a preset number of database events can be randomly selected from all database events whose occurrence time is within the basic time period as candidate database events corresponding to the web page operation information of the first audit event.

[0122] In addition, if the total number of all database events occurring within the basic time period is less than a preset number, all database events occurring within the basic time period can be directly used as candidate database events corresponding to the webpage operation information of the first audit event.

[0123] Optionally, when the current time reaches the start time of the basic time period, newly added database events can be obtained from the database log, and the newly added database events can be determined as alternative database events corresponding to the web page operation information of the first audit event. When the current time reaches the end time of the basic time period, the acquisition of newly added database events from the database log is stopped.

[0124] In addition, if the second audit event is obtained before the end time of the basic time period arrives, the acquisition of new database events from the database log is stopped.

[0125] Step S204, according to the occurrence count of the candidate database events corresponding to the webpage operation information, determine the target database event corresponding to the webpage operation information from the candidate database events corresponding to the webpage operation information, and record the first association relationship between the webpage operation information and the target database event.

[0126] Specifically, when the number of occurrences of the alternative database event corresponding to the web page operation information meets the first preset condition, the alternative database event corresponding to the web page operation information can be determined as the target database event corresponding to the web page operation information; wherein the first preset condition includes at least one of the following: the number of occurrences is greater than or equal to the first preset threshold; the number of occurrences is within the preset number ranking.

[0127] In some embodiments, multiple candidate database events corresponding to the web page operation information may be sorted in descending order of occurrence frequency, and the candidate database events ranked within the first preset number of rankings may be used as the target database events corresponding to the web page operation information.

[0128] The multiple candidate database events corresponding to the webpage operation information may also be sorted in ascending order of occurrence frequency, and the candidate database event ranked within the last preset number of rankings may be used as the target database event corresponding to the webpage operation information.

[0129] The first association relationship is used to determine the web page operation information corresponding to the target database event through the first association relationship when generating an audit log of the target database event, so that the audit log of the target database event includes the web page operation information of the target database event.

[0130] The association relationship generation method provided by the embodiment of the present application estimates the time period during which the database event triggered by the first audit event will exist, that is, the basic time period corresponding to the first audit event, by using the occurrence time of the first audit event and the estimated duration of the event, that is, the estimated duration of the database event triggered by the first audit event. Then, according to the basic time period of the first audit event, the candidate database event corresponding to the web page operation information of the first audit event and the number of occurrences of the candidate database event are obtained from the database log. Since the basic time period of the first audit event is the estimated time period during which the database event triggered by the first audit event will exist. Therefore, according to the basic time period, the candidate database event obtained from the database log is very likely to be a database event triggered by the first audit event. Finally, according to the number of occurrences of the candidate database event corresponding to the web page operation information, the target database event corresponding to the web page operation information is determined from the candidate database event corresponding to the web page operation information. In this way, the correlation between the candidate database event and the web page operation information can be determined according to the number of occurrences of the candidate database event, and then the target database event corresponding to the web page operation information can be determined. Finally, the first association relationship between the web page operation information and the target database event is recorded. So that when an audit log of a target database event is subsequently generated, the web page operation information corresponding to the target database event can be determined through the first association relationship, so that the audit log of the target database event includes the web page operation information of the target database event, thereby associating the database operation information and the specific operation information of the client in the audit log.

[0131] Embodiment 2

[0132] Based on the above embodiment 1, since there may be multiple first audit events, among the multiple first audit events, there may be first audit events corresponding to web page operation information with the same content. Furthermore, for web page operation information with the same content, there may be multiple first association relationships. In order to merge multiple first association relationships, the present application provides a flowchart of an association relationship generation method, combined with Figure 3 As shown, the association relationship generation method may include the following steps:

[0133] Step S301, obtaining multiple first audit events and web page operation information of each first audit event.

[0134] Step S302: Determine the basic time period corresponding to each first audit event according to the occurrence time of each first audit event and the preset estimated duration of the event. The basic time period represents the time period during which the database event triggered by the first audit event lasts.

[0135] Step S303: According to the basic time period of each first audit event, the candidate database events corresponding to the webpage operation information of each first audit event and the number of occurrences of the candidate database events are obtained from the database log.

[0136] Step S304: for each web page operation information, according to the number of occurrences of the candidate database event corresponding to the web page operation information, determine the target database event corresponding to the web page operation information from the candidate database events corresponding to the web page operation information, and record the first association relationship between the web page operation information and the corresponding target database event. The first association relationship is used to determine the web page operation information corresponding to the target database event through the first association relationship when generating an audit log of the target database event, so that the audit log of the target database event includes the web page operation information of the target database event.

[0137] Step S305: determine whether there is identical web page operation information with identical content among the web page operation information.

[0138] Step S306: associate and save the content of each identical webpage operation information with the first target database event to obtain a second association relationship. The first target database event includes all different target database events recorded in the first association relationship of each identical webpage operation information.

[0139] Furthermore, since the second association relationship may include multiple first target database events, in order to determine the database event with which the web page operation information has an association relationship among the multiple first target database events, the following operations need to be performed for each web page operation information: if there are multiple first target database events corresponding to the web page operation information, push the first information to be confirmed; the first information to be confirmed includes multiple first target database events corresponding to the web page operation information. Receive first feedback information of the first information to be confirmed; the first feedback information includes a specified target database event; the specified target database event is one of the multiple first target database events corresponding to the web page operation information. Delete the first target database events except the specified target database event in the second association relationship corresponding to the web page operation information.

[0140] In addition, if the first feedback information does not include the specified target database event, the third information to be confirmed is pushed, the third information to be confirmed includes all candidate database events corresponding to the webpage operation information, and the third feedback information of the third information to be confirmed is received, the third feedback information includes the specified candidate database event. The specified candidate database event is saved in the second association relationship of the webpage operation information, and all the first target database events are deleted.

[0141] The association relationship generation method provided in the embodiment of the present application obtains the second association relationship by associating and saving the content of each identical web page operation information and the first target database event. Since the first target database event includes all different target database events recorded in the first association relationship of each identical web page operation information, the second association relationship thus obtained may include all different target database events corresponding to the web page operation information, thereby avoiding repeated storage of the same target database event.

[0142] Embodiment 3

[0143] Based on the above-mentioned first embodiment, when there are multiple first audit events, there may be first audit events including web page operation information with the same content. And each first audit event, even if it includes web page operation information with the same content, may have different corresponding candidate database events. In order to be able to count the candidate database events corresponding to web page operation information with the same content in different basic time periods, the embodiment of the present application provides a flow chart of another method for generating association relationships. Combined with Figure 4 As shown, the association relationship generation method may include the following steps:

[0144] Step S401, obtaining multiple first audit events and web page operation information of each first audit event.

[0145] Step S402, determining the basic time period corresponding to each first audit event according to the occurrence time of each first audit event and the preset estimated duration of the event. The basic time period represents the time period during which the database event triggered by the first audit event lasts;

[0146] Step S403: merge all web page operation information with the same content into one web page operation information.

[0147] Step S404, for each web page operation information, respectively according to the basic time period of each first audit event with the web page operation information, obtain the candidate database event corresponding to the web page operation information and the number of occurrences of the candidate database event from the database log.

[0148] Specifically, for each web page operation information and for each first audit event with the web page operation information, when the current time reaches the start time of the basic time period of the first audit event, a newly added database event is obtained from the database log, and the newly added database event is determined as an alternative database event for the web page operation information; when the current time reaches the end time of the basic time period of the first audit event, the acquisition of the newly added database event from the database log is stopped.

[0149] If the second audit event is obtained before the end time of the basic time period of the first audit event, or a preset number of candidate database events have been obtained, then the acquisition of new database events from the database log can be stopped, or the end time of the basic time period of the first audit event can be updated to the current time. In this way, the candidate database event corresponding to the webpage operation information and the number of occurrences of the candidate database event can be obtained.

[0150] In some embodiments, for the web page operation information H, the first audit events having the web page operation information H are N1 and N2 respectively.

[0151] For the first audit event N1, when the current time reaches the start time T1 of the basic time period of the first audit event N1, newly added database events, such as W1, W2, and W3, can be obtained in the database log. At the same time, the number of occurrences of W1, W2, and W3 in the basic time period of the first audit event N1 is 1. When the current time reaches the end time T2 of the basic time period of the first audit event N1, stop obtaining newly added database events from the database log. Database events W1, W2, and W3 can be determined as candidate database events for webpage operation information H.

[0152] For the first audit event N2, when the current time reaches the start time T3 of the basic time period of the first audit event N2, newly added database events, such as W1, W2 and W4, can be obtained in the database log. It can be seen that the number of occurrences of W1, W2 and W4 in the basic time period of the first audit event N2 is 1. When the current time reaches the end time T4 of the basic time period of the first audit event N2, stop obtaining newly added database events from the database log. In this case, it can be determined that W1 and W2 have appeared once in the basic time period of the first audit event N1. Therefore, when W1 and W2 appear again in the basic time period of the first audit event N2, the number of occurrences of the candidate database event W1 and the candidate database event W2 of the web page operation information H can be updated, and the number of occurrences of the candidate database event W1 and the candidate database event W2 of the web page operation information H is determined to be 2 times. W4 appears for the first time, so W4 can be determined as the candidate database event of the web page operation information H, and the number of occurrences is 1.

[0153] Step S405: for each web page operation information, according to the number of occurrences of the candidate database event corresponding to the web page operation information, determine the target database event corresponding to the web page operation information from the candidate database events corresponding to the web page operation information, and record the first association relationship between the web page operation information and the corresponding target database event. The first association relationship is used to determine the web page operation information corresponding to the target database event through the first association relationship when generating an audit log of the target database event, so that the audit log of the target database event includes the web page operation information of the target database event.

[0154] Specifically, for each webpage operation information, if the number of occurrences of the candidate database event corresponding to the webpage operation information meets the second preset condition, then push the second information to be confirmed, and the second information to be confirmed includes the candidate database event; receive the second feedback information of the second information to be confirmed; if the second feedback information indicates that there is a first association relationship between the candidate database event and the webpage operation information, determine the candidate database event as the target database event corresponding to the webpage operation information; wherein the second preset condition includes at least one of the following: the number of occurrences is greater than or equal to the second preset threshold; the number of occurrences is within the preset number ranking. wherein the second preset threshold may be greater than the first preset threshold, and the second preset threshold may also be equal to the first preset threshold.

[0155] In the case where all the second feedback information indicates that there is no first association relationship between the candidate database event and the webpage operation information, the preset number is increased; the preset number represents the number of candidate database events corresponding to the webpage operation information of the first audit event expected to be obtained from the database log;

[0156] Correspondingly, according to the basic time period of the first audit event, the candidate database events corresponding to the webpage operation information of the first audit event are obtained from the database log, including:

[0157] In the database log, according to the increased preset number, database events whose occurrence time is within the basic time period are selected as candidate database events corresponding to the web page operation information of the first audit event.

[0158] The association relationship generation method provided by the embodiment of the present application is to merge all the webpage operation information with the same content into one webpage operation information, and then for each webpage operation information, obtain the candidate database event corresponding to the webpage operation information and the number of occurrences of the candidate database event from the database log according to the basic time period of each first audit event with the webpage operation information, so that the candidate database event corresponding to the webpage operation information with the same content in different basic time periods and the number of occurrences of the candidate database event can be counted. And after merging the webpage operation information with the same content, obtain the corresponding candidate database event and the number of occurrences of the candidate database event for each operation information, and then push the second to-be-confirmed information when the number of occurrences of the candidate database event corresponding to the webpage operation information meets the second preset condition. Since there may be multiple candidate database events corresponding to the webpage operation information, by determining that the number of occurrences of the candidate database event meets the second preset condition, the candidate database event with a greater correlation with the webpage operation information can be pushed, so as to more quickly determine the target database event corresponding to the webpage operation information from multiple candidate database events. Finally, second feedback information of the second information to be confirmed is received. When the second feedback information indicates that there is a first correlation between the alternative database event and the web page operation information, the alternative database event is determined as the target database event corresponding to the web page operation information. In this way, the target database event can be determined more accurately and quickly among the multiple alternative database events corresponding to the web page operation information.

[0159] Embodiment 4

[0160] Based on the above embodiment, this embodiment provides a flow chart of an audit log generation method. Figure 5 As shown, the audit log generation method may include the following steps:

[0161] Step S501, when a database event is received, determining the web page operation information corresponding to the database event according to the first association relationship between the preset web page operation information and the target database event, wherein the first association relationship between the preset web page operation information and the target database event is generated by the association relationship generation method of the above embodiment.

[0162] In some embodiments, the first association between the webpage operation information and the target database event is stored in a hash table, wherein the value corresponding to the target database event is a hash key, and the webpage operation information is stored as a hash value in a node with the value corresponding to the target database event as a hash key, and the value corresponding to the target database event is obtained by performing a hash calculation on characteristic fields such as the operation type, table name, and field of the target database event.

[0163] Correspondingly, the web page operation information corresponding to the database event is determined according to the first association relationship between the preset web page operation information and the target database event, including: performing hash calculations on characteristic fields such as the operation type, table name, and field of the database event to obtain the numerical value corresponding to the database event, and using the numerical value corresponding to the database event to perform a matching operation in the hash table to obtain the web page operation information corresponding to the database event.

[0164] Optionally, the audit event corresponding to the database event may also be obtained according to the occurrence time of the database event and the webpage operation information corresponding to the database event.

[0165] Audit events are events recorded in information systems for tracking and reviewing system activities. Audit events may include one or more of the following information: user ID, timestamp, source address, etc. User ID represents the identity information of the user who performed the operation. Timestamp represents the time when the audit event occurred. Source address represents the IP address or host name of the client that initiated the request.

[0166] Specifically, in the client log, audit events whose difference between the occurrence time and the occurrence time of the database event is within a preset difference range and include web page operation information corresponding to the database event can be screened out, and the screened audit events can be determined as audit events corresponding to the database event.

[0167] The minimum value of the preset difference range can be equal to zero. When the difference between the occurrence time of the audit event and the occurrence time of the database event is equal to 0, it indicates that the occurrence time of the audit event is the same as the occurrence time of the database event. The maximum value of the preset difference range is a positive number greater than zero. When the occurrence time of the audit event is earlier than the occurrence time of the database event, the difference between the occurrence time of the audit event and the occurrence time of the database event is greater than 0.

[0168] Step S502: Generate an audit log corresponding to the database event by using the database event and the webpage operation information corresponding to the database event.

[0169] Specifically, an audit log including database events and web page operation information corresponding to the database events is generated.

[0170] Correspondingly, the audit log corresponding to the database event can also be generated by using the database event and the audit event corresponding to the database event.

[0171] Specifically, an audit log including database events and audit events corresponding to the database events is generated.

[0172] In addition, an audit log including database events, web page operation information corresponding to the database events, and audit events corresponding to the database events may also be generated.

[0173] In some embodiments, if the web page operation information corresponding to the database event already exists in the audit event corresponding to the database event, an audit log including only the database event and the audit event corresponding to the database event can be generated. Even if the web page operation information corresponding to the database event already exists in the audit event corresponding to the database event, an audit log including the database event, the web page operation information corresponding to the database event, and the audit event corresponding to the database event can be generated. If the web page operation information corresponding to the database event does not exist in the audit event corresponding to the database event, an audit log including the database event, the web page operation information corresponding to the database event, and the audit event corresponding to the database event can be generated.

[0174] The audit log generation method provided by the embodiment of the present application determines the web page operation information corresponding to the database event according to the first association relationship between the preset web page operation information and the target database event when a database event is received, and then generates the audit log corresponding to the database event using the database event and the web page operation information corresponding to the database event. In this way, the audit log includes not only the database event, but also the web page operation information corresponding to the database event. Therefore, through the audit log, the operation information of the database can be known from the database event in the audit log, and the specific client and even the specific operation information of the user on the client can be known through the web page operation information corresponding to the database event in the audit log.

[0175] Embodiment 5

[0176] This embodiment is based on the above embodiments and is used to further illustrate the present application.

[0177] When the first audit event with a uniform resource identifier is obtained, the occurrence time of the first audit event is taken as the benchmark, and the occurrence time of the first audit event is, for example, 11:31:31, and the sum of the occurrence time of the first audit event and the estimated duration of the event is calculated, and the estimated duration of the event is, for example, 2 seconds, to obtain the first time, 11:31:33. In this way, the basic time period with 11:31:31 as the start time and 11:31:33 as the end time is obtained.

[0178] When the current time reaches the start time of the basic time period, 11:31:31, the newly added database events are obtained from the database log. When the current time reaches the end time of the basic time period, 11:31:33, the newly added database events are stopped from being obtained from the database log. In this way, the alternative database events A, B and C corresponding to the uniform resource identifier of the first audit event are obtained.

[0179] The uniform resource identifier is used as the key and stored in the preset hash table. For each candidate database event corresponding to the uniform resource identifier, the characteristic fields such as the operation type, table name, and field in each candidate database event are made into hashkey and stored in the node with the uniform resource identifier as the key. The number of occurrences is configured for each candidate database event, and a countdown of a specific time length is configured for the uniform resource identifier.

[0180] When a newly added first audit event with a uniform resource identifier is obtained, the candidate database events corresponding to the uniform resource identifier of the newly added first audit event, such as A, B and D, can also be obtained in the above manner.

[0181] If the hash table does not include the uniform resource identifier of the newly added first audit event, the newly added uniform resource identifier is used as the key and stored in the hash table. For each candidate database event corresponding to the newly added uniform resource identifier, the characteristic fields such as the operation type, table name, and field in each candidate database event are made into a hash key and stored in the node with the newly added uniform resource identifier as the key. The number of occurrences is configured for each candidate database event, and a countdown of a specific time length is configured for the uniform resource identifier.

[0182] If the uniform resource identifier of the newly added first audit event already exists in the hash table, then each candidate database event corresponding to the uniform resource identifier of the newly added first audit event is used in the hash table to match each candidate database event corresponding to the same uniform resource identifier. If the match is successful, the number of occurrences of the successfully matched candidate database event in the hash table is increased by 1. If the match fails, it means that in the hash table, the candidate database event corresponding to the uniform resource identifier of the newly added first audit event is different from each candidate database event corresponding to the same uniform resource identifier. Then, the characteristic fields such as the operation type, table name, and field in the candidate database event are made into hash keys and stored in the node with the uniform resource identifier as the key. And the number of occurrences is configured for the candidate database event.

[0183] At the same time, the alternative database events in the hash table are screened at every preset period. For each alternative database event in the hash table, if the number of occurrences corresponding to the alternative database event does not change for more than the set time, the alternative database event and the number of occurrences of the alternative database event are deleted from the hash table. In addition, in the case where the alternative database event is triggered by the database system, the alternative database event can also be deleted from the hash table. In some embodiments, the database system will automatically update the data in the database, which will also trigger the generation of database events, but the generation of the database event is completely unrelated to the first audit event, so the database event can be deleted from the hash table to avoid the subsequent determination of the target database event corresponding to the web page operation information from the alternative database events corresponding to the web page operation information based on the number of occurrences of the alternative database event corresponding to the web page operation information, and the database event is mistakenly considered to be the target database event corresponding to the uniform resource identifier of the first audit event.

[0184] For each uniform resource identifier, when the countdown time corresponding to the uniform resource identifier returns to 0, in the candidate database events corresponding to the uniform resource identifier, the candidate database events corresponding to the uniform resource identifier are sorted in descending order of the number of occurrences, and if the difference between the number of occurrences of the top two rankings is within the preset threshold range, the second information to be confirmed is pushed to the user, and the second information to be confirmed includes the candidate database events ranked in the top two in terms of number of occurrences, such as A and B. The second feedback information of the second information to be confirmed is obtained, and the second feedback information includes the specified candidate database event, such as A. In this way, the specified candidate database event A can be determined as the target database event corresponding to the uniform resource identifier. In the preset association relationship hash table, the hash key of the target database event A is used as the key, and the uniform resource identifier is used as the value to be stored in the node with the hash key of the target database event A as the key. The second feedback information can also include the name of the uniform resource identifier, such as the name of the search software. In the case where the name of the uniform resource identifier is included in the second feedback information, the name of the uniform resource identifier can also be stored in the association relationship hash table.

[0185] Thus, when a database event is received, for example, database event A, hash calculation can be performed on characteristic fields such as operation type, table name, and field of database event A to obtain a hash key, and then the obtained hash key is used to perform a matching operation in the association hash table to obtain the uniform resource identifier corresponding to database event A and the name of the uniform resource identifier. An audit log is generated using database event A and the name of the uniform resource identifier corresponding to database event A.

[0186] Furthermore, the audit events corresponding to database event A can be screened out in the client log, and the audit events whose occurrence time is the same as the occurrence time of database event A and include the uniform resource identifier corresponding to database event A are used as the audit events corresponding to database event A, and then the audit log is generated using the names of the audit events corresponding to database event A, database event A, and the uniform resource identifier corresponding to database event A. Since the audit event includes the user identifier and the occurrence time of the audit event, through the audit log, it is possible to understand the specific operations of the specific user at the PC end at the specific time, which affect the specific data information of the database.

[0187] Based on the same inventive concept, the present application embodiment provides a device for generating an association relationship, such as Figure 6 As shown, the association relationship generating device 600 includes: a first acquisition module 601 , a first determination module 602 , a second acquisition module 603 and a second determination module 604 .

[0188] The first acquisition module 601 is used to acquire the first audit event and the webpage operation information of the first audit event. The first determination module 602 is used to determine the basic time period corresponding to the first audit event according to the occurrence time of the first audit event and the preset estimated duration of the event; the basic time period represents the time period in which the database event triggered by the first audit event exists. The second acquisition module 603 is used to acquire the candidate database event corresponding to the webpage operation information of the first audit event and the number of occurrences of the candidate database event from the database log according to the basic time period of the first audit event. The second determination module 604 is used to determine the target database event corresponding to the webpage operation information from the candidate database events corresponding to the webpage operation information according to the number of occurrences of the candidate database event corresponding to the webpage operation information, and record the first association relationship between the webpage operation information and the target database event; wherein the first association relationship is used to determine the webpage operation information corresponding to the target database event through the first association relationship when generating the audit log of the target database event, so that the audit log of the target database event includes the webpage operation information of the target database event.

[0189] In a feasible implementation of an embodiment of the present application, the first determination module 602 is specifically used to calculate the sum of the occurrence time of the first audit event and the estimated duration of the event to obtain the first time; wherein, the basic time period is a time period with the occurrence time of the first audit event as the start time and the first time as the end time.

[0190] In a feasible implementation of an embodiment of the present application, the first determination module 602 is specifically used to calculate the sum of the occurrence time of the first audit event and the preset delay time to obtain the second time; calculate the occurrence time of the first audit event, the estimated duration of the event, and the sum of the delay time to obtain the third time; wherein the basic time period is a time period with the second time as the start time and the third time as the end time.

[0191] In a feasible implementation of the embodiment of the present application, the second acquisition module 603 is specifically used to obtain a newly added database event from the database log when the current time reaches the start time of the basic time period, and determine the newly added database event as a candidate database event corresponding to the webpage operation information of the first audit event;

[0192] When the current time reaches the end time of the basic time period, stop obtaining new database events from the database log.

[0193] In a feasible implementation of the embodiment of the present application, the second acquisition module 603 is further used to stop acquiring new database events from the database log when the second audit event is acquired before the end time of the basic time period arrives.

[0194] In a feasible implementation of the embodiment of the present application, the second acquisition module 603 is further used to update the end time of the basic time period to the current time when the second audit event is acquired before the end time of the basic time period arrives.

[0195] In a feasible implementation of the embodiment of the present application, the second acquisition module 603 is specifically used to select a preset number of database events whose occurrence time is within a basic time period in the database log as alternative database events corresponding to the web page operation information of the first audit event.

[0196] In a feasible implementation of the embodiment of the present application, the second determination module 604 is specifically configured to determine the candidate database event corresponding to the webpage operation information as the target database event corresponding to the webpage operation information when the number of occurrences of the candidate database event corresponding to the webpage operation information satisfies the first preset condition;

[0197] Among them, the first preset condition includes at least one of the following: the number of occurrences is greater than or equal to a first preset threshold; the number of occurrences is within a preset number ranking.

[0198] In a feasible implementation of the embodiment of the present application, there are multiple first audit events; the second determination module 604 is also used to determine whether there is identical web page operation information with the same content between each web page operation information; and merge the first association relationship of each identical web page operation information.

[0199] In a feasible implementation of an embodiment of the present application, the second determination module 604 is specifically used to associate and save the content of each identical web page operation information and the first target database event to obtain a second association relationship; the first target database event includes all different target database events recorded in the first association relationship of each identical web page operation information.

[0200] In a feasible implementation of the embodiment of the present application, the second determination module 604 is further configured to push first to-be-confirmed information for each webpage operation information if there are multiple first target database events corresponding to the webpage operation information; the first to-be-confirmed information includes multiple first target database events corresponding to the webpage operation information;

[0201] Receive first feedback information of the first information to be confirmed; the first feedback information includes a specified target database event; the specified target database event is one of a plurality of first target database events corresponding to the webpage operation information;

[0202] The first target database event except the specified target database event is deleted in the second association relationship corresponding to the webpage operation information.

[0203] In a feasible implementation of the embodiment of the present application, there are multiple first audit events; the association relationship generating device further includes a merging module, before the second acquisition module 603 obtains the candidate database event corresponding to the webpage operation information of the first audit event and the number of occurrences of the candidate database event from the database log according to the basic time period of the first audit event:

[0204] The merging module is used to merge web page operation information with the same content into one web page operation information;

[0205] The second acquisition module 603 is specifically used to obtain, for each web page operation information, the candidate database event corresponding to the web page operation information and the number of occurrences of the candidate database event from the database log according to the basic time period of each first audit event with the web page operation information.

[0206] In a feasible implementation of the embodiment of the present application, the second determination module 604 is further configured to push second to-be-confirmed information for each webpage operation information if the number of occurrences of the candidate database event corresponding to the webpage operation information meets the second preset condition, wherein the second to-be-confirmed information includes the candidate database event;

[0207] Receiving second feedback information of second information to be confirmed;

[0208] In a case where the second feedback information indicates that there is a first association relationship between the candidate database event and the webpage operation information, determining the candidate database event as the target database event corresponding to the webpage operation information;

[0209] Among them, the second preset condition includes at least one of the following: the number of occurrences is greater than or equal to a second preset threshold; the number of occurrences is within the preset number ranking.

[0210] In a feasible implementation of the embodiment of the present application, the second determination module 604 is further used to increase the preset number when all the second feedback information indicates that there is no first association relationship between the candidate database event and the webpage operation information; the preset number represents the number of candidate database events corresponding to the webpage operation information of the first audit event obtained from the database log;

[0211] Correspondingly, the second acquisition module 603 is also used to select, in the database log, database events whose occurrence time is within the basic time period according to the increased preset number as candidate database events corresponding to the web page operation information of the first audit event.

[0212] In a feasible implementation of the embodiment of the present application, the first acquisition module 601 is specifically used to obtain an alternative audit event; if the alternative audit event includes a uniform resource identifier, the alternative audit event is determined to be the first audit event.

[0213] In a feasible implementation of the embodiment of the present application, the web page operation information of the first audit event includes a uniform resource identifier in the first audit event.

[0214] Based on the same inventive concept, the present application embodiment provides an audit log generating device, such as Figure 7 As shown, the audit log generating device 700 includes: a third determining module 701 and a generating module 702 .

[0215] The third determination module 701 is specifically used to determine the web page operation information corresponding to the database event according to the first association relationship between the preset web page operation information and the target database event when a database event is received, wherein the first association relationship between the preset web page operation information and the target database event is generated by the association relationship generation method of the above-mentioned embodiment.

[0216] The generation module 702 is specifically used to generate an audit log corresponding to the database event by using the database event and the webpage operation information corresponding to the database event.

[0217] In an optional implementation of the embodiment of the present application, the third determination module 701 is further used to obtain the audit event corresponding to the database event according to the occurrence time of the database event and the webpage operation information corresponding to the database event. The generation module 702 is further used to generate the audit log corresponding to the database event using the database event and the audit event corresponding to the database event.

[0218] It can be understood that the various embodiments described in the first embodiment are also applicable to other embodiments in the absence of conflict, and will not be described in detail here for the sake of brevity.

[0219] Combination Figure 8 As shown, an embodiment of the present application provides an electronic device, including a processor 810 and a memory 812. Optionally, the device may also include a communication interface 813 and a bus 814. Among them, the processor 810, the communication interface 813, and the memory 812 can communicate with each other through the bus 814. The communication interface 813 can be used for information transmission. The processor 810 can call the logic instructions in the memory 812 to execute the association relationship generation method or the audit log generation method of the above embodiment.

[0220] In addition, the logic instructions in the memory 812 described above may be implemented in the form of software functional units and when sold or used as independent products, may be stored in a computer-readable storage medium.

[0221] The memory 812 is a computer-readable storage medium that can be used to store software programs, computer executable programs, such as program instructions / modules corresponding to the methods in the embodiments of the present application. The processor 810 executes the functional application and data processing by running the program instructions / modules stored in the memory 812, that is, the association relationship generation method or the audit log generation method in the above-mentioned embodiment is implemented.

[0222] The memory 812 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and an application required for at least one function; the data storage area may store data created according to the use of the terminal device, etc. In addition, the memory 812 may include a high-speed random access memory and may also include a non-volatile memory.

[0223] The electronic device may be a computer or a server, etc.

[0224] An embodiment of the present application provides a storage medium storing computer executable instructions, wherein the computer executable instructions are configured to execute the association relationship generation method or the audit log generation method of the above-mentioned embodiment.

[0225] An embodiment of the present application provides a computer program product, which includes a computer program stored on a storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer executes the association relationship generation method or audit log generation method of the above-mentioned embodiment.

[0226] The computer-readable storage medium mentioned above may be a transient computer-readable storage medium or a non-transitory computer-readable storage medium.

[0227] The technical solution of the embodiment of the present application can be embodied in the form of a software product, which is stored in a storage medium and includes one or more instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in the embodiment of the present application. The aforementioned storage medium can be a non-transient storage medium, including: a USB flash drive, a mobile hard disk, a read-only memory, a random access memory, a magnetic disk or an optical disk, etc., which can store program codes, or a transient storage medium.

[0228] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed.

[0229] The above description is only an embodiment of the present application and is not intended to limit the protection scope of the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application. At the same time, the above embodiments can be combined with each other to form new embodiments without conflict.

Claims

1. A method for generating an association relationship, characterized in that: include: Acquire a first audit event and web page operation information of the first audit event; Determine a basic time period corresponding to the first audit event according to the occurrence time of the first audit event and the preset estimated duration of the event; the basic time period represents the time period during which the database event triggered by the first audit event lasts; According to the basic time period of the first audit event, obtaining from the database log the candidate database event corresponding to the webpage operation information of the first audit event and the number of occurrences of the candidate database event; According to the number of occurrences of the alternative database event corresponding to the web page operation information, the target database event corresponding to the web page operation information is determined from the alternative database events corresponding to the web page operation information, and a first association relationship between the web page operation information and the target database event is recorded; wherein, when generating an audit log of the target database event, the first association relationship is used to determine the web page operation information corresponding to the target database event through the first association relationship, so that the audit log of the target database event includes the web page operation information of the target database event.

2. The method according to claim 1, characterized in that Determining a basic time period corresponding to the first audit event according to the occurrence time of the first audit event and the preset estimated duration of the event includes: Calculate the sum of the occurrence time of the first audit event and the estimated duration of the event to obtain a first time; The basic time period is a time period starting from the occurrence time of the first audit event and ending at the first time.

3. The method according to claim 1, characterized in that Determining a basic time period corresponding to the first audit event according to the occurrence time of the first audit event and the preset estimated duration of the event includes: Calculate the sum of the occurrence time of the first audit event and the preset delay time to obtain a second time; Calculate the sum of the occurrence time of the first audit event, the estimated duration of the event, and the delay duration to obtain a third time; The basic time period is a time period starting from the second time and ending at the third time.

4. The method according to claim 1, characterized in that: According to the basic time period of the first audit event, obtaining a candidate database event corresponding to the webpage operation information of the first audit event from the database log includes: When the current time reaches the start time of the basic time period, a newly added database event is obtained from the database log, and the newly added database event is determined as a candidate database event corresponding to the webpage operation information of the first audit event; When the current time reaches the end time of the basic time period, the acquisition of newly added database events from the database log is stopped.

5. The method according to claim 4, characterized in that After acquiring the newly added database event from the database log, the method further includes: If the second audit event is obtained before the end time of the basic time period arrives, then the acquisition of new database events from the database log is stopped.

6. The method according to claim 4, characterized in that After acquiring the newly added database event from the database log, the method further includes: If the second audit event is acquired before the end time of the basic time period arrives, the end time of the basic time period is updated to the current time.

7. The method according to claim 1, characterized in that According to the basic time period of the first audit event, obtaining a candidate database event corresponding to the webpage operation information of the first audit event from the database log includes: In the database log, a preset number of database events whose occurrence time is within the basic time period are selected as candidate database events corresponding to the webpage operation information of the first audit event.

8. The method according to claim 1, characterized in that: Determining a target database event corresponding to the webpage operation information from the candidate database events corresponding to the webpage operation information according to the number of occurrences of the candidate database event corresponding to the webpage operation information includes: When the number of occurrences of the candidate database event corresponding to the webpage operation information satisfies a first preset condition, determining the candidate database event corresponding to the webpage operation information as the target database event corresponding to the webpage operation information; Among them, the first preset condition includes at least one of the following: the number of occurrences is greater than or equal to a first preset threshold; the number of occurrences is within a preset number ranking.

9. The method according to claim 8, characterized in that There are multiple first audit events; when the number of occurrences of the candidate database event corresponding to the webpage operation information meets the first preset condition, the candidate database event corresponding to the webpage operation information is determined as the target database event corresponding to the webpage operation information, and the first association relationship between the webpage operation information and the target database event is recorded, the method further includes: Determine whether there is identical web page operation information with the same content among the web page operation information; The first association relationship of each of the same web page operation information is merged.

10. The method according to claim 9, characterized in that The first association relationship of merging the same web page operation information includes: The content of each of the same web page operation information and the first target database event are associated and saved to obtain a second association relationship; the first target database event includes all different target database events recorded in the first association relationship of each of the same web page operation information.

11. The method according to claim 10, characterized in that After associating and saving the content of each of the same webpage operation information and the first target database event to obtain the second association relationship, the method further includes: For each webpage operation information, if there are multiple first target database events corresponding to the webpage operation information, first to-be-confirmed information is pushed; the first to-be-confirmed information includes multiple first target database events corresponding to the webpage operation information; Receive first feedback information of the first information to be confirmed; the first feedback information includes a specified target database event; the specified target database event is one of a plurality of first target database events corresponding to the webpage operation information; The first target database event other than the designated target database event is deleted from the second association relationship corresponding to the webpage operation information.

12. The method according to claim 1, characterized in that There are multiple first audit events; before obtaining, from a database log, a candidate database event corresponding to the webpage operation information of the first audit event and the number of occurrences of the candidate database event according to a basic time period of the first audit event, the method further includes: Merge all web page operation information with the same content into one web page operation information; Correspondingly, according to the basic time period of the first audit event, obtaining the candidate database event corresponding to the webpage operation information of the first audit event and the number of occurrences of the candidate database event from the database log includes: For each web page operation information, the candidate database event corresponding to the web page operation information and the number of occurrences of the candidate database event are obtained from the database log according to the basic time period of each first audit event having the web page operation information.

13. The method according to claim 12, characterized in that Determining a target database event corresponding to the webpage operation information from the candidate database events corresponding to the webpage operation information according to the number of occurrences of the candidate database event corresponding to the webpage operation information includes: For each webpage operation information, if the number of occurrences of the candidate database event corresponding to the webpage operation information meets the second preset condition, then push the second to-be-confirmed information, where the second to-be-confirmed information includes the candidate database event; receiving second feedback information of the second information to be confirmed; In a case where the second feedback information indicates that there is a first association relationship between the candidate database event and the webpage operation information, determining the candidate database event as the target database event corresponding to the webpage operation information; Among them, the second preset condition includes at least one of the following: the number of occurrences is greater than or equal to a second preset threshold; the number of occurrences is within the preset number ranking.

14. The method according to claim 13, characterized in that The method further comprises: In the case where all the second feedback information indicates that there is no first association relationship between the candidate database event and the webpage operation information, the preset number is increased; the preset number represents the number of candidate database events corresponding to the webpage operation information of the first audit event expected to be obtained from the database log; Correspondingly, according to the basic time period of the first audit event, obtaining the candidate database event corresponding to the webpage operation information of the first audit event from the database log includes: In the database log, according to the increased preset number, database events whose occurrence time is within the basic time period are selected as candidate database events corresponding to the webpage operation information of the first audit event.

15. The method according to any one of claims 1 to 14, characterized in that Get the first audit event, including: Get alternative audit events; If the candidate audit event includes a uniform resource identifier, the candidate audit event is determined to be the first audit event.

16. The method according to any one of claims 1 to 14, characterized in that The web page operation information of the first audit event includes a uniform resource identifier in the first audit event.

17. A method for generating an audit log, characterized in that: include: In the case of receiving a database event, determining the webpage operation information corresponding to the database event according to a preset first association relationship between the webpage operation information and the target database event, wherein the preset first association relationship between the webpage operation information and the target database event is generated by the association relationship generation method according to any one of claims 1 to 16; An audit log corresponding to the database event is generated using the database event and the webpage operation information corresponding to the database event.

18. The method according to claim 17, characterized in that Before generating an audit log corresponding to the database event using the database event and the webpage operation information corresponding to the database event, the method further includes: Acquire the audit event corresponding to the database event according to the occurrence time of the database event and the webpage operation information corresponding to the database event; Correspondingly, generating an audit log corresponding to the database event using the database event and the webpage operation information corresponding to the database event includes: An audit log corresponding to the database event is generated using the database event and the audit event corresponding to the database event.

19. An electronic device, characterized in that: It includes a processor and a memory, the memory stores computer-executable instructions that can be executed by the processor, and the processor executes the computer-executable instructions to implement the association relationship generation method described in any one of claims 1 to 16 or the audit log generation method described in 17 or 18.

20. A storage medium, characterized in that: The storage medium stores computer executable instructions. When the computer executable instructions are called and executed by the processor, the computer executable instructions enable the processor to implement the association relationship generation method described in any one of claims 1 to 16 or the audit log generation method described in 17 or 18.

21. A computer program product, characterized in that The computer program product includes a computer program, which, when executed by a processor, implements the association relationship generation method described in any one of claims 1 to 16 or the audit log generation method described in 17 or 18.

Images