A real-time monitoring system and method for sensitive data based on CDC and UBA

Abstract

The present invention relates to the field of data security and monitoring technology, specifically a system and method for real-time monitoring of sensitive data based on CDC and UBA; the system includes a data source module, a CDC module, a UBA engine module, and a behavior monitoring platform; the CDC module is used to collect the log of the data source module in real time and process it to obtain key operation information; the UBA engine module is used to process the key operation information to obtain abnormal operation behavior; the behavior monitoring platform is used to perform real-time monitoring, alarm, and execute emergency disposal measures according to the abnormal operation behavior. The present invention realizes real-time monitoring of sensitive data, can automatically capture and parse database operation logs, intelligently identify abnormal operation behaviors, and timely execute alarms and emergency disposal measures according to the disposal strategy preset by the user, effectively improving the efficiency and accuracy of sensitive data protection.

Description

Technical Field

[0001] This invention relates to the fields of data security and monitoring technology, specifically to a real-time monitoring system and method for sensitive data based on CDC and UBA. Background Technology

[0002] With the rapid advancement of information technology and the widespread deepening of digital transformation, data has become a key element driving the efficient operation and development of the economy, society, and even the military. The generation, storage, processing, and exchange of data are becoming increasingly frequent. At the same time, data breaches and unauthorized access incidents are rampant, causing significant losses to various organizations and individuals. Especially in some critical areas, sensitive data is particularly important due to its high confidentiality and stringent security requirements; once a security incident occurs, it will pose a serious threat to national security and social stability. Therefore, implementing real-time monitoring of sensitive data domains, rapidly identifying security threats, and automatically taking countermeasures is particularly urgent and important. Summary of the Invention

[0003] The purpose of this invention is to provide a real-time monitoring system and method for sensitive data based on CDC (Change Data Capture) and UBA (User Behavior Analytics) in order to solve at least one of the above-mentioned technical problems.

[0004] The present invention achieves the above objectives through the following technical solutions:

[0005] A real-time monitoring system for sensitive data based on CDC and UBA includes: a data source module, a CDC module, a UBA engine module, and a behavior monitoring platform;

[0006] The CDC module is used to collect the logs of the data source module in real time and process them to obtain key operation information;

[0007] The UBA engine module is used to process the key operation information to obtain abnormal operation behavior;

[0008] The behavior monitoring platform is used to perform real-time monitoring and alerts and execute emergency response measures based on the abnormal operation behavior.

[0009] Furthermore, the data source module includes at least one of the following databases: DM, MySQL, PostgreSQL, MongoDB, and Oracle;

[0010] Furthermore, the CDC module includes: a real-time data acquisition unit, a sensitive data domain log filtering unit, and a sensitive data domain log parsing unit;

[0011] Furthermore, the UBA engine module includes: an abnormal behavior definition algorithm unit and an abnormal behavior annotation unit;

[0012] Furthermore, the behavior monitoring platform includes: a real-time monitoring unit, a handling strategy management unit, a message alarm unit, an execution handling strategy unit, and a log auditing unit.

[0013] A method for real-time monitoring of sensitive data based on CDC and UBA, employing any of the above-described real-time monitoring systems for sensitive data based on CDC and UBA, the method comprising the following steps:

[0014] The CDC module collects logs from the data source module in real time and processes them to obtain key operation information;

[0015] The UBA engine module processes the key operation information to obtain abnormal operation behaviors.

[0016] The behavior monitoring platform performs real-time monitoring and alerts based on the abnormal operational behavior and executes emergency response measures.

[0017] Furthermore, the CDC module collects and processes the logs from the data source module in real time to obtain key operational information, including:

[0018] Logs from the data source module are collected in real time using data acquisition tools;

[0019] Operation logs for sensitive data fields are filtered out based on a preset sensitive data filtering algorithm;

[0020] The operation logs of the sensitive data fields are parsed to obtain the key operation information.

[0021] Furthermore, the key operation information includes: operation subject, operation time, operation object, and operation type.

[0022] Furthermore, the UBA engine module processes the key operation information to obtain abnormal operation behaviors, including:

[0023] Set abnormal access rules;

[0024] The critical operation information is analyzed according to the abnormal access rules, and the abnormal operation behavior is marked.

[0025] Furthermore, set abnormal access rules, including:

[0026] Randomly select access log samples of sensitive data fields for each username within 30 days of a year;

[0027] The 30-day sample log data is sliced ​​by time to generate user data within multiple time slices;

[0028] Calculate the average number of times a user accesses sensitive data domains per day within each time slice;

[0029] Set thresholds for abnormal access marking;

[0030] If, on a given day, within the corresponding time slice, a user accesses a sensitive data domain more times than the abnormal access labeling threshold, then that operation is labeled as the abnormal operation.

[0031] Furthermore, the abnormal operation behaviors include: unauthorized viewing, unauthorized deletion, unauthorized addition, unauthorized modification, continuous unauthorized access, and abnormal access.

[0032] Furthermore, the behavior monitoring platform performs real-time monitoring and alerts and executes emergency response measures based on the aforementioned abnormal operational behaviors, including:

[0033] Establish a strategy for handling abnormal operation events in sensitive data domains;

[0034] The abnormal operation behavior is matched with the handling strategy, and the corresponding handling is carried out according to the matching result. The handling process is also logged.

[0035] Furthermore, the handling strategy includes:

[0036] When unauthorized viewing, deletion, addition, modification, or other abnormal actions occur, the operation will be interrupted and a warning message will be sent.

[0037] If unauthorized access continues, disconnect the operating entity from the database;

[0038] In case of abnormal access, disconnect the operation subject from the database.

[0039] An electronic device includes a processor, a memory, and a computer program stored in the memory and executable on the processor. When executed by the processor, the computer program implements any of the real-time monitoring methods for sensitive data based on CDC and UBA as described above.

[0040] A computer-readable storage medium storing a computer program that, when executed by a processor, implements any of the real-time monitoring methods for sensitive data based on CDC and UBA as described above.

[0041] The beneficial effects of this invention are as follows:

[0042] This invention, by employing CDC technology, can collect, filter, and parse logs of sensitive data domains in real time, providing comprehensive and accurate data support for subsequent real-time monitoring and ensuring the real-time nature and integrity of the data.

[0043] This invention utilizes a custom-designed abnormal behavior definition algorithm within the UBA engine module to perform in-depth analysis of real-time log parsing results. This enables precise labeling of abnormal operational behaviors on sensitive data domains, significantly improving the efficiency and accuracy of operational behavior analysis and greatly enhancing the system's intelligence level. Through algorithm optimization and customization, the system can more accurately identify potential security threats, providing a strong basis for subsequent response measures.

[0044] The behavior monitoring platform of this invention integrates behavior management and behavior handling functions. It can analyze and manage abnormal operation behaviors output by the UBA engine module, and actively alert to abnormal operation behaviors. At the same time, the managed behavior records can support behavior auditing. This function not only improves the real-time monitoring capability of the system, but also provides reliable data support for subsequent behavior auditing. By using matching algorithms to match handling strategies, it automatically handles illegal access behaviors, realizes timely detection and handling of security threats, and effectively reduces the security threats to sensitive data domains.

[0045] This invention enhances the monitoring of operational behavior in sensitive data domains through automation and intelligence. It not only improves the real-time detection of abnormal operations, but also significantly reduces the security threats to sensitive data domains while reducing labor costs. It is of great significance for improving the level of data security and maintaining information security stability. Attached Figure Description

[0046] Figure 1 This is a structural diagram of a real-time sensitive data monitoring system based on CDC and UBA according to one embodiment of the present invention;

[0047] Figure 2 This is a schematic diagram of a real-time sensitive data monitoring system based on CDC and UBA according to one embodiment of the present invention.

[0048] Figure 3 This is an architecture diagram of a real-time sensitive data monitoring system based on CDC and UBA according to one embodiment of the present invention;

[0049] Figure 4 This is a flowchart of a real-time monitoring method for sensitive data based on CDC and UBA according to one embodiment of the present invention;

[0050] Figure 5 This is a business process diagram of a CDC module according to one embodiment of the present invention;

[0051] Figure 6 This is a business process diagram of a UBA engine module according to one embodiment of the present invention;

[0052] Figure 7 This is a business process diagram of a behavior monitoring platform according to one embodiment of the present invention. Detailed Implementation

[0053] The invention will now be discussed with reference to exemplary embodiments. It should be understood that the described embodiments are merely intended to enable those skilled in the art to better understand and thus implement the invention, and are not intended to imply any limitation on the scope of the invention.

[0054] As used herein, the term "comprising" and its variations are to be interpreted as open-ended terms meaning "including but not limited to". The term "based on" is to be interpreted as "at least partially based on". The terms "one embodiment" and "an embodiment" are to be interpreted as "at least one embodiment".

[0055] Example 1

[0056] Figure 1 This is a structural diagram of a real-time sensitive data monitoring system based on CDC and UBA according to one embodiment of the present invention; Figure 2 This is a schematic diagram of a real-time sensitive data monitoring system based on CDC and UBA according to one embodiment of the present invention. Figure 3 This is an architecture diagram of a real-time sensitive data monitoring system based on CDC and UBA, according to one embodiment of the present invention. Figure 1-3 As shown, according to one embodiment of the present invention, a real-time monitoring system for sensitive data based on CDC and UBA includes: a data source module, a CDC module, a UBA engine module, and a behavior monitoring platform.

[0057] The CDC module is used to collect logs from the data source module in real time and process them to obtain key operation information;

[0058] The UBA engine module is used to process critical operation information and obtain abnormal operation behaviors.

[0059] The behavior monitoring platform is used to monitor and alert on abnormal operational behaviors in real time and to implement emergency response measures.

[0060] Preferably, the data source module includes at least one of the following databases: DM, MySQL, PostgreSQL, MongoDB, Oracle;

[0061] Preferably, the CDC module includes: a real-time data acquisition unit, a sensitive data domain log filtering unit, and a sensitive data domain log parsing unit;

[0062] Preferably, the UBA engine module includes: an abnormal behavior definition algorithm unit and an abnormal behavior annotation unit;

[0063] Preferably, the behavior monitoring platform includes: a real-time monitoring unit, a handling strategy management unit, a message alarm unit, an execution handling strategy unit, and a log auditing unit.

[0064] In this embodiment, the real-time sensitive data monitoring system based on CDC and UBA can be applied to various database environments, such as DM, MySQL, PostgreSQL, MongoDB, Oracle, etc. The data source module includes multiple sensitive data domain units.

[0065] The CDC module connects to the data source module and collects its logs in real time, i.e., it captures the database logs. The CDC module includes a real-time data acquisition unit, a sensitive data domain log filtering unit, and a sensitive data domain log parsing unit. The real-time data acquisition unit captures database logs in real time, including logs from database and table addition, deletion, and update operations, as well as logs from data value queries, insertions, updates, and deletions. The sensitive data domain log filtering unit filters operation logs for sensitive data domains based on a preset KeyData sensitive data domain identifier. The sensitive data domain log parsing unit parses the logs and sends the parsing results to the UBA engine module as messages.

[0066] The UBA engine is responsible for receiving the parsing results of sensitive data domain logs sent by the CDC module. The UBA engine module includes: an abnormal behavior definition algorithm unit and an abnormal behavior annotation unit. The abnormal behavior definition algorithm unit is used to perform in-depth analysis and calculation on the parsing results based on the abnormal operation behavior definition algorithm; the abnormal behavior annotation unit is used to automatically annotate abnormal operation behaviors on sensitive data domains and send the annotation results to the behavior monitoring platform in the form of messages.

[0067] The behavior monitoring platform, as the system's management platform, is responsible for receiving abnormal operational behaviors on sensitive data domains output by the UBA engine module. The behavior monitoring platform includes: a real-time monitoring unit, a handling strategy management unit, a message alarm unit, an execution handling strategy unit, and a log auditing unit. The real-time monitoring unit receives abnormal operational behaviors output by the UBA engine module in real time; the handling strategy management unit stores user-defined handling strategies for abnormal operational behaviors; based on the matching results between abnormal operational behaviors, the message alarm unit and the execution handling strategy unit execute corresponding real-time monitoring alarms and emergency handling measures; and the log auditing unit logs the system's proactive handling processes.

[0068] This real-time sensitive data monitoring system, based on Change Data Capture (CDC) and User Behavior Analysis (UBA), aims to achieve comprehensive monitoring of sensitive data across various database environments, including DM, MySQL, PostgreSQL, MongoDB, and Oracle. The system comprises four core components: a data source module, a CDC module, a UBA engine module, and a behavior monitoring platform. The data source module, as the origin of sensitive data, contains multiple sensitive data domain units. The CDC module captures various operation logs from the database in real time through its real-time data acquisition unit, and filters and parses these logs using sensitive data domain log filtering and parsing units to extract key operation information. This information is then sent to the UBA engine module, which uses an abnormal behavior definition algorithm unit to perform in-depth analysis and calculations on the parsing results, and automatically labels abnormal operation behaviors through an abnormal behavior annotation unit. Finally, these abnormal operation behaviors are transmitted to the behavior monitoring platform, which receives this information in real time through a real-time monitoring unit and executes corresponding real-time monitoring alarms and emergency response measures according to user-preset handling strategies (stored by the handling strategy management unit). Simultaneously, the log auditing unit logs the entire handling process to ensure system traceability and security.

[0069] This invention enables comprehensive and real-time monitoring of sensitive data in various database environments. It can automatically capture and parse database operation logs, intelligently identify abnormal operation behaviors, and promptly execute alarms and emergency response measures according to user-preset handling strategies. At the same time, it records the handling process logs to ensure the traceability and security of the system, effectively improving the efficiency and accuracy of sensitive data protection.

[0070] Example 2

[0071] like Figure 1 As shown, according to one embodiment of the present invention, a real-time monitoring system for sensitive data based on CDC and UBA includes: a data source module, a CDC module, a UBA engine module, and a behavior monitoring platform.

[0072] Using the logs of the data domain storing sensitive data as the data source, the CDC module collects log data in real time, filters and parses the sensitive data domain log data. The UBA engine module analyzes the parsing results based on a custom UBA engine abnormal behavior algorithm and marks abnormal operation behaviors in the data domain. The behavior monitoring platform monitors and alerts on abnormal operation behaviors in the sensitive data domain, performs emergency handling for abnormal behaviors, and audits the logs. The system can be applied to various database environments, such as DM, MySQL, PostgreSQL, MongoDB, Oracle, etc.

[0073] The data source module includes multiple sensitive data field units;

[0074] The CDC module includes: a real-time data acquisition unit, a sensitive data domain log filtering unit, and a sensitive data domain log parsing unit;

[0075] The CDC module is responsible for capturing database logs in real time, including logs of database and table addition, deletion, and update operations, as well as logs of data value queries, insertions, updates, and deletions. It filters operation logs for sensitive data fields using a preset KeyData sensitive data field identifier, parses the logs, and sends the parsing results to the UBA engine module as messages.

[0076] The UBA engine module includes: an abnormal behavior definition algorithm unit and an abnormal behavior annotation unit;

[0077] The UBA engine module is responsible for receiving the parsing results of sensitive data domain logs sent by the CDC module, performing in-depth analysis and calculation on the parsing results based on the abnormal operation behavior definition algorithm, automatically marking abnormal operation behaviors on sensitive data domains, and sending the marking results to the behavior monitoring platform in the form of messages.

[0078] The behavior monitoring platform includes: a real-time monitoring unit, a handling strategy management unit, a message alarm unit, an execution handling strategy unit, and a log auditing unit;

[0079] As the system's management platform, the behavior monitoring platform is responsible for receiving abnormal operation behaviors on sensitive data domains output by the UBA engine module, and for performing real-time monitoring and alarms and emergency response measures for abnormal behavior based on the handling strategies set by the user.

[0080] This invention, by cleverly integrating CDC technology and an advanced UBA engine, constructs a highly efficient and intelligent real-time monitoring system for sensitive data. This system not only possesses powerful real-time monitoring capabilities, rapidly capturing any unauthorized operations targeting sensitive data, but also incorporates an automated processing mechanism that can take immediate action upon detecting abnormal behavior, effectively curbing potential security threats. This invention also provides detailed log auditing capabilities, enabling security teams to comprehensively track and analyze the operational history of sensitive data, further enhancing the transparency and traceability of security protection. This invention not only meets the urgent needs of the military field for efficient and secure protection of sensitive data but also sets a new benchmark for other industries requiring high data security.

[0081] Example 3

[0082] Figure 4 This is a flowchart illustrating a real-time monitoring method for sensitive data based on CDC and UBA, according to one embodiment of the present invention. Figure 4As shown, according to one embodiment of the present invention, a real-time monitoring method for sensitive data based on CDC and UBA, employing any of the real-time monitoring systems for sensitive data based on CDC and UBA of the present invention, includes the following steps:

[0083] Step S102: The CDC module collects logs from the data source module in real time and processes them to obtain key operation information;

[0084] Step S104: The UBA engine module processes key operation information to obtain abnormal operation behavior;

[0085] Step S106: The behavior monitoring platform performs real-time monitoring and alarms and executes emergency response measures based on abnormal operation behaviors.

[0086] In this implementation, the CDC module first collects database operation logs and filters them according to a preset KeyData sensitive data domain identifier to obtain sensitive data domain operation logs. These logs are then parsed to obtain key operation information such as the operation subject, operation time, operation object, and operation type. This parsed key operation information is sent to the UBA engine module as a message. The UBA engine module performs in-depth analysis of data domain operation behavior using an abnormal behavior definition algorithm and labels abnormal operation behaviors. After the behavior labeling is completed, the labeled sensitive data domain operation behaviors are input into the behavior monitoring platform. The platform persistently stores normal operations based on the labeling results, supporting log auditing; it also issues alerts for abnormal operation behaviors and proactively handles them according to the handling strategy, achieving proactive protection of sensitive data domains.

[0087] This method deeply integrates Change Data Capture (CDC) and User Behavior Analysis (UBA) technologies, achieving its goal through the construction of a high-efficiency real-time monitoring system. In practice, the CDC module first uses data acquisition tools (such as Flink CDC, Flume, and Filebeats) to capture real-time log information from the data source module. These logs cover various database operation records. Using pre-defined KeyData sensitive data domain identifiers, the CDC module can accurately filter operation logs related to sensitive data and further parse these logs to extract key operation details, such as the operation subject, execution time, specific object of the operation, and operation type. This key operation information is then processed and instantly transmitted to the UBA engine module in the form of messages. The UBA engine module uses an abnormal behavior definition algorithm to deeply analyze the received sensitive data domain operation behaviors, aiming to identify any abnormal operations that deviate from normal behavior patterns and annotate them. This step is crucial for timely detection and response to potential security threats. Subsequently, these annotated sensitive data domain operation behaviors are sent to the behavior monitoring platform. In response to abnormal operational behaviors, the behavior monitoring platform automatically takes a series of proactive defense measures based on preset handling strategies, such as blocking abnormal accounts and recording details of abnormal behaviors, thereby achieving effective protection and real-time monitoring of sensitive data domains.

[0088] This invention can capture and process database operation logs in real time, accurately filter operation information of sensitive data domains, and use an abnormal behavior definition algorithm to perform in-depth analysis of operation behavior, promptly discovering and marking abnormal operations. The behavior monitoring platform then persistently stores normal operations to support log auditing based on the marking results, and triggers real-time monitoring alarms and executes emergency response measures for abnormal operations, such as blocking abnormal accounts. This achieves effective protection, real-time monitoring and proactive protection of sensitive data domains, significantly improving the efficiency and accuracy of data security protection.

[0089] According to one embodiment of the present invention, step S102 includes:

[0090] Logs from the data source module are collected in real time using data acquisition tools;

[0091] Operation logs for sensitive data fields are filtered out based on a preset sensitive data filtering algorithm;

[0092] Parse the operation logs of sensitive data fields to obtain key operation information.

[0093] Preferably, the key operation information includes: operation subject, operation time, operation object, and operation type.

[0094] In this embodiment, the business process of the CDC module in step S102 is defined in detail. Specifically, firstly, by configuring the log collection data source, advanced data collection tools (such as Flink CDC, Flume, Filebeats, etc.) are used to achieve real-time capture of database logs in the data source module. During the collection process, the CDC module intelligently detects each operation log record based on a sensitive data filtering algorithm, identifying and filtering logs containing preset KeyData sensitive data field identifiers. These filtered logs are operation behavior records for sensitive data fields, carrying key information about changes in sensitive data. Next, the CDC module performs in-depth analysis of these sensitive data field operation logs, accurately extracting core elements such as the operation subject (i.e., the user or system performing the operation), operation time (the specific time point when the operation occurred), operation object (the sensitive data item being operated on), and operation type (such as add, delete, modify, etc.). After this key information is organized, it is seamlessly transmitted to the subsequent UBA (User Behavior Analysis) engine module in the form of structured messages, providing a solid foundation for subsequent abnormal behavior detection and real-time monitoring.

[0095] This invention not only enables real-time capture and in-depth analysis of sensitive data operation behaviors, but also greatly improves the accuracy and efficiency of data security monitoring, laying a solid technical foundation for building a comprehensive and efficient sensitive data protection system.

[0096] According to one embodiment of the present invention, step S104 includes:

[0097] Set abnormal access rules;

[0098] Analyze key operation information based on abnormal access rules and mark abnormal operation behaviors.

[0099] Preferably, abnormal access rules are set, including:

[0100] Randomly select access log samples of sensitive data fields for each username within 30 days of a year;

[0101] The 30-day sample log data is sliced ​​by time to generate user data within multiple time slices;

[0102] Calculate the average number of times a user accesses sensitive data domains per day within each time slice;

[0103] Set thresholds for abnormal access marking;

[0104] If, on a given day, within the corresponding time slice, a user accesses a sensitive data domain more times than the abnormal access labeling threshold, then that operation is labeled as an abnormal operation.

[0105] Preferably, abnormal operation behaviors include: unauthorized viewing, unauthorized deletion, unauthorized addition, unauthorized modification, continuous unauthorized access, and abnormal access.

[0106] In this embodiment, the business process of the UBA engine module in step S104 is defined in detail to accurately identify and label abnormal operation behaviors. Specifically, a set of abnormal access rules is first established. This set of rules is based on a sample of sensitive data domain access logs for each username over a period of 30 days within one year. These sample logs are processed by time slicing, such as dividing them into three time periods: 8:00 to 18:00, 18:00 to 0:00, and 0:00 to 8:00. The average number of times a user accesses the sensitive data domain per day within each time slice is counted, and an abnormal access labeling threshold is set based on this. When a user's access frequency within a specific time slice exceeds the abnormal access labeling threshold, their behavior is labeled as abnormal operation behavior, including unauthorized viewing, unauthorized deletion, unauthorized addition, unauthorized modification, continuous unauthorized access, and other abnormal access types. Finally, the UBA engine module sends the labeled sensitive data domain, operation subject, abnormal behavior category, and operation time, etc., to the behavior monitoring platform in the form of a message, providing strong support for subsequent security measures.

[0107] This invention sets abnormal access rules in real-time monitoring of sensitive data through the UBA engine module. It uses a sample of access logs for sensitive data domains from 30 days within a year for time-slice analysis, calculates the average number of user accesses in each time slice and sets thresholds, accurately identifies and labels various abnormal behaviors including unauthorized operations, continuous unauthorized access and abnormal access, effectively improving the accuracy and efficiency of sensitive data security monitoring, and providing strong data support for subsequent security measures.

[0108] According to one embodiment of the present invention, step S106 includes:

[0109] Establish a strategy for handling abnormal operation events in sensitive data domains;

[0110] The abnormal operation behavior is matched with the handling strategy, and the corresponding handling is carried out according to the matching result. The handling process is also logged.

[0111] Preferably, the handling strategy includes:

[0112] When unauthorized viewing, deletion, addition, modification, or other abnormal actions occur, the operation will be interrupted and a warning message will be sent.

[0113] If unauthorized access continues, disconnect the operating entity from the database;

[0114] In case of abnormal access, disconnect the operation subject from the database.

[0115] In this embodiment, the business process of the behavior monitoring platform in step S106 is defined in detail to efficiently respond to abnormal operation events in sensitive data domains. The platform integrates functions such as handling strategy management, operation behavior monitoring, and abnormal behavior handling. First, through the handling strategy management unit, the system can flexibly set handling strategies for various abnormal operations (such as unauthorized viewing, deletion, addition, modification, continuous unauthorized access, and abnormal access), ensuring a rapid response when abnormal behavior occurs. During the setting of handling strategies, the system checks whether a handling strategy exists. If it already exists, it prompts "Measure already exists"; if it does not exist, the system requires filling in the attribute information of the handling strategy. If the entered attribute information is correct, the handling strategy is saved, completing the handling strategy definition corresponding to the abnormal operation event; if the entered handling strategy information is incorrect, the system needs to re-enter the handling strategy information until the entered attribute information is correct. Once the behavior analysis engine detects an abnormal operation and sends a message containing key information such as the sensitive data domain name, the operator, the type of abnormal behavior, and the operation time to the behavior monitoring platform, the platform will immediately parse this information and issue a visible alert on the monitoring homepage using warning icons, warning colors, and flashing alarms. Simultaneously, this information will be persistently stored in the log audit database for subsequent auditing. Subsequently, according to preset handling policy rules, the behavior monitoring platform will automatically and proactively handle different types of illegal operations. For example, it may interrupt unauthorized operations and issue a warning via message, or disconnect the operator from the database in cases of continuous unauthorized or abnormal access. The entire handling process will be recorded in detail in the logs to ensure that every step is traceable and auditable.

[0116] This invention enables efficient handling of abnormal operation events in sensitive data domains, significantly improves data security protection, enhances system response speed and automated processing capabilities, and ensures that every operation is traceable and auditable.

[0117] Example 4

[0118] Figure 5 This is a business process diagram of a CDC module according to one embodiment of the present invention; Figure 6 This is a business process diagram of a UBA engine module according to one embodiment of the present invention; Figure 7 This is a business process diagram of a behavior monitoring platform according to one embodiment of the present invention. Figure 5-7 As shown, according to one embodiment of the present invention, a real-time monitoring system and method for sensitive data based on CDC and UBA, applicable to any of the real-time monitoring systems for sensitive data based on CDC and UBA of the present invention, the method includes the following steps:

[0119] Step 1: Configure the log collection data source. The CDC module collects database logs in real time through data collection tools (such as Flink CDC, Flume, Filebeats, etc.).

[0120] Step 2: The filtering algorithm checks whether the operation log records contain a preset keyData sensitive data field identifier; if the operation log contains a sensitive data field name, it is determined that the operation log records the operation behavior of the sensitive data field.

[0121] Step 3: Parse the operation log records of sensitive data fields to obtain key information such as operation subject, operation time, operation object, and operation type.

[0122] Step 4: Analyze access behavior to sensitive data domains and label any abnormal behaviors. Abnormal behaviors include unauthorized viewing, unauthorized deletion, unauthorized addition, unauthorized modification, continuous unauthorized access, and other unusual access.

[0123] Step 5: Define abnormal access rules. Randomly select access log samples of sensitive data fields for each username over a period of 30 days within one year. The formula for selecting the 30-day log data sample is as follows:

[0124] D i =Random i (0, 364)

[0125] Among them, D i The integer between 0 and 365 represents the i-th extraction; 0 represents the first day of the year (January 1st), 364 represents the last day of the year (not considering leap years), and so on, to determine the date corresponding to the selected log data.

[0126] The 30-day sample log data was sliced ​​by time to generate user data within multiple time slices, namely 8:00 to 18:00, 18:00 to 0:00, and 0:00 to 8:00.

[0127] The formula for calculating the average number of times a user accesses sensitive data domains per day within each time slice is as follows:

[0128]

[0129] Where M represents the average number of times a user accesses the sensitive data domain per day within each time slice of the 30-day sample log data; m i This indicates the number of times a user accesses the sensitive data domain each day within a 30-day sample log data period.

[0130] Set an abnormal access threshold p%. If, on a given day, within a corresponding time slice, the number of times a user accesses a sensitive data field, n, exceeds the set threshold, then the exceeding action is marked as abnormal access. The formula is as follows:

[0131] n > (1 + p%)M? Abnormal behavior: Normal behavior Step Nine: The behavior analysis engine sends key information such as the tagged sensitive data domain name, the operating entity, the abnormal behavior category, and the operation time to the behavior monitoring platform via messages.

[0132] The behavior monitoring platform includes functions such as handling strategy management, operational behavior monitoring, and abnormal behavior handling, such as... Figure 7 As shown, its business process is as follows:

[0133] Step 10: Handling Strategy Management involves setting up handling measures for abnormal operation events in sensitive data domains. When defining measures, the system first checks if a handling measure already exists. If it does, the system will display "Measure already exists"; if it doesn't exist, you need to fill in the attribute information for the handling measure. If the entered attribute information is correct, the handling strategy will be saved, completing the definition of the handling strategy corresponding to the abnormal operation event. If the entered handling strategy information is incorrect, you need to re-enter the information until the entered attribute information is correct.

[0134] The handling strategies include: (1) When unauthorized viewing, deletion, addition, modification, or other abnormal behaviors occur, the system will interrupt the operation and issue a warning message; (2) When unauthorized access continues, the connection between the operating entity and the database will be disconnected; (3) When abnormal access occurs, the connection between the operating entity and the database will be disconnected.

[0135] Step 11: Operation Behavior Monitoring. Receive messages from the behavior analysis engine containing key information such as sensitive data domain names, operation subjects, abnormal behavior categories, and operation times.

[0136] Step 11: Parse the abnormal behavior messages, display the abnormal behavior on the monitoring homepage and persist it to the log audit database to support log auditing, and make explicit alerts using methods such as "alert icons", "alert colors", and "alert flashing".

[0137] Step 12: Based on the alarm event handling strategy rules set in Step 10, proactively handle different illegal operations, such as issuing alerts for unauthorized viewing, modification, deletion, and addition operations; disconnecting the connection between the operating entity and the database when unauthorized access continues; disconnecting the connection between the operating entity and the database when abnormal access occurs.

[0138] Step 13: Log the proactive handling process performed by the system.

[0139] In this implementation, the CDC module first collects database operation logs and filters them according to a preset KeyData sensitive data domain identifier to obtain sensitive data domain operation logs. These sensitive data domain operation logs are then parsed to obtain key information such as the operation subject, operation time, operation object, and operation type. This parsed key information is sent to the UBA engine module in the form of a message. The UBA engine module's abnormal operation behavior algorithm performs in-depth analysis of the data domain operation behavior and marks abnormal operation behaviors. After the behavior marking is completed, the marked sensitive data domain operation behaviors are input into the behavior monitoring platform. The behavior monitoring platform will persistently store normal operations based on the marking results to support log auditing functions; and issue alarms for abnormal operation behaviors and proactively handle them according to the handling strategy, achieving proactive protection of sensitive data domains.

[0140] The real-time monitoring system and method for sensitive data based on CDC and UBA proposed in this invention have achieved significant improvements and optimizations in several aspects, specifically reflected in:

[0141] 1. Efficient Data Acquisition and Filtering: By integrating advanced CDC (Change Data Capture) technology, the system can collect database logs in real time and accurately, and apply efficient filtering algorithms to quickly identify operation logs containing preset keyData sensitive data field identifiers. This process not only ensures the comprehensiveness and timeliness of the data, but also lays a solid foundation for subsequent analysis of sensitive data field operation behavior.

[0142] 2. Deep Behavioral Analysis and Annotation: The system's built-in custom UBA (User and Entity Behavior Analytics) engine utilizes advanced abnormal operation behavior algorithms to perform in-depth mining and analysis of real-time parsed log data. Through this mechanism, the system can accurately annotate abnormal operation behaviors on sensitive data domains, such as unauthorized viewing, deletion, addition, and modification, thereby greatly improving the efficiency and accuracy of behavioral analysis.

[0143] 3. Comprehensive Behavior Management and Handling: The behavior monitoring platform integrates behavior management and handling functions, enabling comprehensive monitoring and management of operational behaviors output by the UBA engine. The behavior management function not only analyzes and proactively alerts to abnormal operational behaviors in real time, but also persists behavior records to a log audit database to support subsequent log auditing. The behavior handling function automatically matches handling strategies using a matching algorithm to promptly and effectively handle unauthorized access behaviors, such as interrupting operations or disconnecting database connections, thereby achieving timely detection and rapid response to security threats.

[0144] 4. Intelligent Monitoring and Risk Reduction: This system significantly enhances the monitoring capabilities of operational behavior in sensitive data domains through automation and intelligence. Through a series of processes including real-time monitoring, in-depth analysis, proactive alerts, and automated handling, the system not only drastically reduces labor costs but also significantly improves the real-time detection of abnormal operations. These combined measures effectively reduce security threats to sensitive data domains, ensuring the security and stability of data assets.

[0145] Example 5

[0146] According to one embodiment of the present invention, an electronic device includes a processor, a memory, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, it implements any of the real-time monitoring methods for sensitive data based on CDC and UBA of the present invention.

[0147] According to one embodiment of the present invention, a computer-readable storage medium stores a computer program, which, when executed by a processor, implements any of the real-time sensitive data monitoring methods based on CDC and UBA of the present invention.

[0148] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the equipment and media described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0149] The above description is merely a preferred embodiment of this application and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of the invention involved in this application is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the inventive concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this application.

[0150] It should be understood that the sequence number of each step in the invention and embodiments of the present invention does not absolutely imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

Claims

1. A real-time monitoring system for sensitive data based on CDC and UBA, characterized in that: include: Data source module, CDC module, UBA engine module, behavior monitoring platform; The CDC module is used to collect the logs of the data source module in real time and process them to obtain key operation information; The UBA engine module is used to process the key operation information to obtain abnormal operation behavior; The behavior monitoring platform is used to perform real-time monitoring and alarm and execute emergency response measures based on the abnormal operation behavior.

2. The sensitive data real-time monitoring system based on CDC and UBA according to claim 1 is characterized in that: The data source module includes at least one of the following databases: DAMO, MySQL, PostgreSQL, MongoDB, Oracle; And / or, the CDC module includes: a real-time data collection unit, a sensitive data domain log screening unit, and a sensitive data domain log parsing unit; And / or, the UBA engine module includes: an abnormal behavior definition algorithm unit, an abnormal behavior annotation unit; And / or, the behavior monitoring platform includes: a real-time monitoring unit, a disposal strategy management unit, a message alarm unit, an execution disposal strategy unit, and a log audit unit.

3. A method for real-time monitoring of sensitive data based on CDC and UBA, using the real-time monitoring system for sensitive data based on CDC and UBA as described in any one of claims 1-2, characterized in that: The method comprises the following steps: The CDC module collects the logs of the data source module in real time and processes them to obtain key operation information; The UBA engine module processes the key operation information to obtain abnormal operation behavior; The behavior monitoring platform performs real-time monitoring, alarms and executes emergency response measures based on the abnormal operation behavior.

4. The method for real-time monitoring of sensitive data based on CDC and UBA according to claim 3, characterized in that: The CDC module collects logs from the data source module in real time and processes them to obtain key operation information, including: Collecting the logs of the data source module in real time through a data collection tool; Filter out operation logs of sensitive data domains according to the preset sensitive data screening algorithm; The operation log of the sensitive data domain is parsed to obtain the key operation information.

5. The method for real-time monitoring of sensitive data based on CDC and UBA according to claim 4, characterized in that: The key operation information includes: operation subject, operation time, operation object, and operation type.

6. The method for real-time monitoring of sensitive data based on CDC and UBA according to claim 3, characterized in that: The UBA engine module processes the key operation information to obtain abnormal operation behaviors, including: Set exception access rules; The key operation information is analyzed according to the abnormal access rule, and the abnormal operation behavior is marked.

7. The method for real-time monitoring of sensitive data based on CDC and UBA according to claim 6, characterized in that: Set exception access rules, including: Randomly select access log samples of sensitive data domains of each user name within 30 days of one year; Slice the 30-day sample log data by time and generate user data in multiple time slices; Count the average number of times users access sensitive data domains per day in each time slice; Set the abnormal access annotation threshold; If on a certain day, in a corresponding time slice, the number of times a user accesses a sensitive data domain exceeds the abnormal access marking threshold, the operation behavior is marked as the abnormal operation behavior.

8. The method for real-time monitoring of sensitive data based on CDC and UBA according to claim 6, characterized in that: The abnormal operation behaviors include: unauthorized viewing, unauthorized deletion, unauthorized addition, unauthorized modification, continuous unauthorized access, and abnormal access.

9. The method for real-time monitoring of sensitive data based on CDC and UBA according to claim 3, characterized in that: The behavior monitoring platform performs real-time monitoring and alarming and executes emergency response measures based on the abnormal operation behavior, including: Set up strategies for handling abnormal operation events in sensitive data domains; The abnormal operation behavior is matched with the handling strategy, corresponding handling is performed according to the matching result, and the handling process is recorded in a log.

10. The method for real-time monitoring of sensitive data based on CDC and UBA according to claim 9, characterized in that: The disposal strategies include: When unauthorized viewing, deletion, addition, modification, or other abnormal behaviors occur, the operation will be interrupted and an early warning will be issued in the form of a message; If unauthorized access continues, disconnect the operation subject from the database; In case of abnormal access, the connection between the operation subject and the database is disconnected.

Images