A database resource management system and method based on authority control

Abstract

The present invention discloses a database resource management system and method based on authority control, which belongs to the technical field of database resource management. The method comprises collecting and classifying database resource information and constructing a resource category identification system; collecting user access operation information and screening out high-frequency access resources through statistical analysis; extracting features related to user authority access and constructing an authority prediction model based on user behavior; capturing user operation requests in real time, combining context information, extracting real-time features related to authority, and inputting the features into a trained authority prediction model to predict whether the user will access high-frequency resources and verify role authority; if it is predicted that the user will access high-frequency resources and has authority, hierarchically controlling the user's access authority according to the user role and the current usage of data resources; the above method effectively improves the security of database resource access, reduces the risk of data leakage caused by authority abuse, and optimizes resource allocation.

Description

Technical Field

[0001] The present invention relates to the technical field of database resource management, and in particular to a database resource management system and method based on authority control. Background Art

[0002] In today's digital age, databases, as critical infrastructure for storing and managing massive amounts of data, are widely used across businesses, governments, research institutions, and other sectors. In database resource management, permission control is a core component of ensuring data security. It determines the access and operational permissions that different users or roles have for various resources in the database.

[0003] Currently, database permission control mainly relies on role-based access control (RBAC) or attribute-based access control (ABAC) models, and their permission allocation is usually centered on static rules. However, in dynamic business scenarios, database resource access patterns are characterized by high frequency and strong correlations, making it difficult for traditional models to adapt to the dynamic changes in resource usage. For example, some data resources frequently accessed by core businesses lack dynamic adaptability in permission settings. During peak business hours, when a large number of users initiate access requests simultaneously, this can easily lead to system performance bottlenecks and affect overall business efficiency. At the same time, due to fixed permissions, these high-frequency resources remain at the same authorization level for a long time. Once they are attacked by malicious attacks, the lack of a layered protection mechanism can easily lead to an increased risk of data leakage. In addition, existing solutions are mostly based on preset roles or attribute rules and lack in-depth analysis of historical user behavior patterns, resulting in a disconnect between permission allocation and actual needs. They are unable to predict and intercept unconventional access behaviors, such as sudden high-frequency operations, and pose a risk of data leakage or abuse. Summary of the Invention

[0004] The purpose of the present invention is to provide a database resource management system and method based on authority control to solve the problems raised in the above background technology.

[0005] In order to solve the above technical problems, the present invention provides the following technical solution: a database resource management method based on authority control, the method comprising:

[0006] Step S100: Collect database resource information and extract multi-dimensional features, classify database resources using a clustering algorithm, and build a resource category identification system; collect user access operation information from the database management system log and store it in the operation log data warehouse, and filter out frequently accessed resources through statistical analysis;

[0007] Step S200: extracting user permission access related features from the operation log data warehouse, and combining the extracted database resource features to build a permission prediction model based on user behavior;

[0008] Step S300: Capture user operation requests in real time, combine context information, extract and preprocess real-time features related to permissions, and input them into the trained permission prediction model to predict whether the user will access high-frequency resources. At the same time, combine the user role access control list set by the database system to preliminarily determine whether the user's current operation is within the user's normal permission range;

[0009] Step S400: If it is predicted that the user will access high-frequency resources and is preliminarily determined to have permission, hierarchical permission control is triggered. User access rights are hierarchically controlled based on the user role and current data resource usage, and a hierarchical permission control notification is sent to the user accessing the high-frequency resources.

[0010] Furthermore, the step S100 includes:

[0011] Step S101: Traverse all resources in the database, including various data tables, views, and storage locations; for each resource, extract multidimensional metadata information, including table name, field type, data volume, access user role and corresponding permissions, resource modification time, and predefined sensitivity labels; the sensitivity labels include three categories: public, internal, and confidential; for each resource, construct a resource feature vector Ri=[ri1, ri2, ri3], where Ri represents the feature vector of the i-th database resource, ri1 represents the data sensitivity of the i-th database resource, ri2 represents the permission association of the i-th database resource, and ri3 represents the data dynamics of the i-th database resource; the data sensitivity is labeled according to the set business rules, 0 represents public data, 1 represents internal data, and 2 represents confidential data; the permission association is used to count the number of user roles associated with accessing the resource; the data dynamics is used to calculate the number of days between the last modification time of the resource and the current time;

[0012] Step S102: Use the DBSCAN clustering algorithm to classify database resources, calculate the Euclidean distance between resource feature vectors, determine the nearest neighbor distance dmin of each resource feature vector, summarize the nearest neighbor distances of all resource feature vectors, and draw a distance graph, where the horizontal axis is the data point index and the vertical axis is the nearest neighbor distance of the corresponding point. Connect the points in the order of the data point index to form a curve, and select the distance value corresponding to the first inflection point on the curve as the neighborhood radius e; define the minimum number of neighborhood points Mp, and determine the core points, boundary points, and noise points based on e and Mp; if the resource feature vector Ri If the nearest neighbor distance dmin is less than or equal to e, and the number of points contained in its neighborhood is at least Mp, then Ri is a core point; if Ri is not a core point, but Ri's neighborhood e contains at least one core point, then Ri is a boundary point; if Ri is neither a core point nor a boundary point, then Ri is a noise point; divide the core point and the points in its neighborhood into different clusters, each cluster represents a database resource category; build a resource category classification system, assign a unique identifier to each category, establish a mapping relationship between resources and classification identifiers, and store the resource's unique identifier and the corresponding classification identifier in the resource classification table of the database;

[0013] Step S103: The database management system collects user access information, including operation timestamp, operation type, database resources involved, IP address of the terminal initiating the operation, and operation results, and stores the information in the operation log data warehouse; an initial statistical period is defined, and the total number of resource accesses within the statistical period is divided by the number of time units within the period to obtain the average number of accesses as the initial access frequency F0; an exponentially weighted moving average algorithm is used, and the time window is set to a fixed length T. The calculation formula is F t =α×A t + (1-α) × F t-1 , where F t is the access frequency of the resource at the current moment, A t is the actual number of resource accesses in the current time window T, α is the time decay factor where 0<α<1, F t-1 is the access frequency of the resource at the last moment, and F is the initial calculation frequency. t-1 =F0; set an access frequency threshold β, and set F t Resources greater than or equal to β are screened out as high-frequency access resources; by performing statistical analysis on historical access frequency data, the mean and standard deviation are calculated, and the threshold β is set to the mean plus k times the standard deviation, where k is the coefficient for adjusting the threshold.

[0014] Furthermore, the step S200 includes:

[0015] Step S201: Extract features related to user permission access from the operation log data warehouse, including operation timestamp, operation type, involved database resources, operation initiation terminal IP address, and operation result. At the same time, extract the feature "whether it is a high-frequency resource" from the high-frequency access resource information filtered out in step S100. Extract key features from the collected historical behavior data to construct a user behavior feature vector U = [operation timestamp, operation type, operation initiation terminal IP address, operation result, access frequency, whether access is to a high-frequency resource]. Perform missing value processing, outlier processing, and data normalization on the extracted features. Construct a target label for the model. If the operation record involves a high-frequency resource, the label is set to 1; if not, the label is set to 0.

[0016] Step S202: Divide the collected user behavior data and the database resource data in step S100 into a training set and a test set in a ratio of 8:2, and use the random forest algorithm to build a dynamic permission prediction model, with the user behavior feature vector U and the resource feature vector Ri as input; set the parameters of the random forest algorithm, including the number of trees and the maximum depth, and use the cross-validation method to evaluate and optimize the model. During the training process, continuously adjust the model parameters; the model outputs the probability of users accessing high-frequency resources, using accuracy, recall rate, F1 value, ROC-AUC and logarithmic loss as evaluation indicators.

[0017] The accuracy, recall, F1 value, ROC-AUC, and logarithmic loss are all performance evaluation indicators of the dynamic permission prediction model, among which ROC-AUC is used to evaluate the accuracy of the model in predicting the probability of users accessing high-frequency resources;

[0018] First, the trained dynamic permission model is used to predict the test set and obtain the probability value of each sample belonging to the positive class. The positive class indicates that the user accesses high-frequency resources.

[0019] Using an equal-interval selection method, multiple thresholds are defined between 0 and 1. The model's predicted probability is compared with the threshold. If the probability is greater than the threshold, the sample is predicted as positive; otherwise, it is predicted as negative, indicating that the user does not access high-frequency resources. Next, based on whether the user in the test set actually accesses high-frequency resources, the true positive rate and false positive rate are calculated. The true positive rate represents the proportion of samples that the model correctly predicts as positive among all samples that actually access high-frequency resources. The false positive rate represents the proportion of samples that the model incorrectly predicts as positive among all samples that do not actually access high-frequency resources.

[0020] The false positive rate calculated at different thresholds is used as the horizontal axis and the true positive rate as the vertical axis. Each point is plotted in a rectangular coordinate system, and then these points are connected to obtain the ROC curve. The area under the ROC curve is calculated using the trapezoidal method. The area under the ROC curve is divided into multiple small trapezoids. The area of ​​each small trapezoid is calculated and summed to obtain the AUC value. The AUC value range is between 0 and 1. The larger the value, the better the performance of the model:

[0021] When AUC=1, it means that the model can completely distinguish between positive and negative samples. All positive samples can be correctly predicted, and all negative samples can also be correctly predicted.

[0022] When AUC <= 0.5, it means that the model's predictions are unable to distinguish between positive and negative samples;

[0023] When AUC is between 0.5 and 1, the closer the AUC is to 1, the better the model performance is, and the more effectively it can distinguish positive and negative samples. Set the accuracy, recall, F1 value, ROC-AUC, and logarithmic loss thresholds. When each indicator reaches or exceeds the threshold, stop model training.

[0024] Furthermore, the step S300 includes:

[0025] Step S301: Capture user database operation requests in real time, including the operation initiation time, the initiating user's unique identity, and the operation instructions, and temporarily store the obtained information in a temporary storage area; read the operation instructions from the temporary storage area, parse the operation instructions using an SQL parsing tool, and extract the operation type, database target access resource, and operation conditions through parsing; at the same time, collect context information associated with the user operation, including user role and permission information, the IP address of the terminal device currently used for login, and the network environment information of the terminal device;

[0026] Step S302: Construct a real-time user behavior feature vector according to Step S200. Extract key features from the real-time captured operation requests and context information, construct a real-time feature vector and perform preprocessing. Input the preprocessed real-time feature vector into the trained permission prediction model. The model outputs the prediction probability P of whether the user will access high-frequency resources. Set a probability threshold f, where f ∈ (0, 1). If P >= f, query the user role access control list pre-set and stored in the database system. According to the unique identifier of the user who发起请求 (initiates the request), find the user's affiliated role and the preset permission information granted to the role for the current requested resource. By comparing the preset permission information with the type of the current operation request, preliminarily determine whether the user's current operation conforms to the normal permission range of the user. If the preset permission includes the current operation type, it is determined that the permission range is met, and the hierarchical permission control process is triggered. If P < f, process the user's operation request according to the default permission configuration of the database system, allowing the user to operate with regular permissions.

[0027] Further, the step S400 includes:

[0028] Step S401: The database pre-defines different user roles, including ordinary users, advanced users, and administrators. Each role has different responsibilities and permission scopes in the database. If it is predicted according to Step S300 that the user will access high-frequency resources and it is preliminarily determined that the user has permissions, then trigger hierarchical permission control. Real-time obtain the concurrent access quantity of the data resource.

[0029] Step S402: When the concurrent access quantity of the data resource is higher than the set concurrent quantity threshold, set the upper limit of the single access duration for ordinary users to access high-frequency resources. Monitor the access time through a built-in timer. Once the time is exceeded, automatically terminate the access connection and pop up a prompt window for the user. The single access duration limit for advanced users to access high-frequency resources is x minutes, and a warning pop-up window is sent to the user in advance for a period of time to prompt the remaining access time. The database system will record the long-term operation behavior of the administrator. If the continuous access exceeds a hours, send an email warning to the monitoring personnel to prompt to pay attention to whether the administrator's operation is abnormal. While performing hierarchical control on the user's access permissions, generate a detailed hierarchical permission control notice. The notice content includes the user's current role, the concurrent access quantity of the current data resource, the access permissions granted to the user, and the validity period of the permission limit.

[0030] A database resource management system based on permission control, the system includes a resource management module, a user behavior analysis module, a real-time permission determination module, and a hierarchical permission control module;

[0031] The resource management module is used to collect database resource information and extract multi-dimensional features, classify database resources using clustering algorithms, and build a resource category identification system; collect user access operation information from the database management system log and store it in the operation log data warehouse, and screen out frequently accessed resources through statistical analysis;

[0032] The user behavior analysis module extracts user permission access related features from the operation log data warehouse and builds a permission prediction model based on user behavior in combination with the extracted database resource features;

[0033] The real-time permission determination module captures user operation requests in real time, combines context information, extracts and preprocesses real-time features related to permissions, and inputs them into the trained permission prediction model to predict whether the user will access high-frequency resources. At the same time, combined with the user role access control list set by the database system, it preliminarily determines whether the user's current operation is within the user's normal permission range;

[0034] If the hierarchical permission control module predicts that the user will access high-frequency resources and preliminarily determines that the user has permission, it triggers hierarchical permission control, and controls the user's access rights in a hierarchical manner according to the user role and the current usage of data resources, and sends a hierarchical permission control notification to the user accessing the high-frequency resources.

[0035] Compared with the prior art, the present invention has the following beneficial effects:

[0036] This invention uses a clustering algorithm to deeply classify database resources, construct a resource category identification system, and systematically divide database resources according to their multi-dimensional characteristics. Compared with the traditional classification method based on simple directories or single attributes, the classification method of this invention allows administrators to have a clearer understanding of the resource architecture, making it more targeted when allocating permissions and optimizing resource configuration.

[0037] This invention captures user operation requests in real time, combines contextual information to construct feature vectors, and inputs them into a permission prediction model trained based on user behavior and database resource characteristics. It can dynamically predict whether a user will access high-frequency resources. The invention focuses on risk prevention and control of high-frequency resource access. Based on real-time user behavior trends, it captures potential high-frequency resource access behaviors and predicts risks in advance. This effectively addresses the problem of insufficient supervision of high-frequency resource access in traditional permission management systems when faced with complex and changing user operations, and avoids illegal or excessive access to sensitive high-frequency resources due to response delays.

[0038] The present invention sends hierarchical permission control notifications to users, informing them in detail of key information such as the current permission status, resource usage, etc., allowing users to understand the operation boundaries in real time, avoid erroneous operations caused by unclear permissions, and improve operation fluency; on the other hand, through the permission judgment process, combined with the user role access control list and real-time permission prediction, it ensures that user operations are compliant throughout the process. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0040] Figure 1 The present invention is a method flow chart of a database resource management method based on permission control. DETAILED DESCRIPTION

[0041] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0042] See also Figure 1 The present invention provides a technical solution: a database resource management method based on authority control, the method comprising:

[0043] Step S100: Collect database resource information and extract multi-dimensional features, classify database resources using a clustering algorithm, and build a resource category identification system; collect user access operation information from the database management system log and store it in the operation log data warehouse, and filter out frequently accessed resources through statistical analysis;

[0044] Step S200: extracting user permission access related features from the operation log data warehouse, and combining the extracted database resource features to build a permission prediction model based on user behavior;

[0045] Step S300: Capture user operation requests in real time, combine context information, extract and preprocess real-time features related to permissions, and input them into the trained permission prediction model to predict whether the user will access high-frequency resources. At the same time, combine the user role access control list set by the database system to preliminarily determine whether the user's current operation is within the user's normal permission range;

[0046] Step S400: If it is predicted that the user will access high-frequency resources and is preliminarily determined to have permission, hierarchical permission control is triggered. User access rights are hierarchically controlled based on the user role and current data resource usage, and a hierarchical permission control notification is sent to the user accessing the high-frequency resources.

[0047] Furthermore, the step S100 includes:

[0048] Step S101: Traverse all resources in the database, including various data tables, views, and storage locations; for each resource, extract multidimensional metadata information, including table name, field type, data volume, access user role and corresponding permissions, resource modification time, and predefined sensitivity labels; the sensitivity labels include three categories: public, internal, and confidential; for each resource, construct a resource feature vector Ri=[ri1, ri2, ri3], where Ri represents the feature vector of the i-th database resource, ri1 represents the data sensitivity of the i-th database resource, ri2 represents the permission association of the i-th database resource, and ri3 represents the data dynamics of the i-th database resource; the data sensitivity is labeled according to the set business rules, 0 represents public data, 1 represents internal data, and 2 represents confidential data; the permission association is used to count the number of user roles associated with accessing the resource; the data dynamics is used to calculate the number of days between the last modification time of the resource and the current time;

[0049] Step S102: Use the DBSCAN clustering algorithm to classify database resources, calculate the Euclidean distance between resource feature vectors, determine the nearest neighbor distance dmin of each resource feature vector, summarize the nearest neighbor distances of all resource feature vectors, and draw a distance graph, where the horizontal axis is the data point index and the vertical axis is the nearest neighbor distance of the corresponding point. Connect the points in the order of the data point index to form a curve, and select the distance value corresponding to the first inflection point on the curve as the neighborhood radius e; define the minimum number of neighborhood points Mp, and determine the core points, boundary points, and noise points based on e and Mp; if the resource feature vector Ri If the nearest neighbor distance dmin is less than or equal to e, and the number of points contained in its neighborhood is at least Mp, then Ri is a core point; if Ri is not a core point, but Ri's neighborhood e contains at least one core point, then Ri is a boundary point; if Ri is neither a core point nor a boundary point, then Ri is a noise point; divide the core point and the points in its neighborhood into different clusters, each cluster represents a database resource category; build a resource category classification system, assign a unique identifier to each category, establish a mapping relationship between resources and classification identifiers, and store the resource's unique identifier and the corresponding classification identifier in the resource classification table of the database;

[0050] Step S103: The database management system collects user access information, including operation timestamp, operation type, database resources involved, IP address of the terminal initiating the operation, and operation results, and stores the information in the operation log data warehouse; an initial statistical period is defined, and the total number of resource accesses within the statistical period is divided by the number of time units within the period to obtain the average number of accesses as the initial access frequency F0; an exponentially weighted moving average algorithm is used, and the time window is set to a fixed length T. The calculation formula is F t =α×A t + (1-α) × F t-1 , where F t is the access frequency of the resource at the current moment, A t is the actual number of resource accesses in the current time window T, α is the time decay factor where 0<α<1, F t-1 is the access frequency of the resource at the last moment, and F is the initial calculation frequency. t-1 =F0; set an access frequency threshold β, and set F t Resources greater than or equal to β are screened out as high-frequency access resources; by performing statistical analysis on historical access frequency data, the mean and standard deviation are calculated, and the threshold β is set to the mean plus k times the standard deviation, where k is the coefficient for adjusting the threshold.

[0051] Furthermore, the step S200 includes:

[0052] Step S201: Extract features related to user permission access from the operation log data warehouse, including operation timestamp, operation type, involved database resources, operation initiation terminal IP address, and operation result. At the same time, extract the feature "whether it is a high-frequency resource" from the high-frequency access resource information filtered out in step S100. Extract key features from the collected historical behavior data to construct a user behavior feature vector U = [operation timestamp, operation type, operation initiation terminal IP address, operation result, access frequency, whether access is to a high-frequency resource]. Perform missing value processing, outlier processing, and data normalization on the extracted features. Construct a target label for the model. If the operation record involves a high-frequency resource, the label is set to 1; if not, the label is set to 0.

[0053] Step S202: Divide the collected user behavior data and the database resource data in step S100 into a training set and a test set in a ratio of 8:2, and use the random forest algorithm to build a dynamic permission prediction model, with the user behavior feature vector U and the resource feature vector Ri as input; set the parameters of the random forest algorithm, including the number of trees and the maximum depth, and use the cross-validation method to evaluate and optimize the model. During the training process, continuously adjust the model parameters; the model outputs the probability of users accessing high-frequency resources, using accuracy, recall rate, F1 value, ROC-AUC and logarithmic loss as evaluation indicators.

[0054] The accuracy, recall, F1 value, ROC-AUC, and logarithmic loss are all performance evaluation indicators of the dynamic permission prediction model, among which ROC-AUC is used to evaluate the accuracy of the model in predicting the probability of users accessing high-frequency resources;

[0055] First, the trained dynamic permission model is used to predict the test set and obtain the probability value of each sample belonging to the positive class. The positive class indicates that the user accesses high-frequency resources.

[0056] Using an equal-interval selection method, multiple thresholds are defined between 0 and 1. The model's predicted probability is compared with the threshold. If the probability is greater than the threshold, the sample is predicted as positive; otherwise, it is predicted as negative, indicating that the user does not access high-frequency resources. Next, based on whether the user in the test set actually accesses high-frequency resources, the true positive rate and false positive rate are calculated. The true positive rate represents the proportion of samples that the model correctly predicts as positive among all samples that actually access high-frequency resources. The false positive rate represents the proportion of samples that the model incorrectly predicts as positive among all samples that do not actually access high-frequency resources.

[0057] The false positive rate calculated at different thresholds is used as the horizontal axis and the true positive rate as the vertical axis. Each point is plotted in a rectangular coordinate system, and then these points are connected to obtain the ROC curve. The area under the ROC curve is calculated using the trapezoidal method. The area under the ROC curve is divided into multiple small trapezoids. The area of ​​each small trapezoid is calculated and summed to obtain the AUC value. The AUC value range is between 0 and 1. The larger the value, the better the performance of the model:

[0058] When AUC=1, it means that the model can completely distinguish between positive and negative samples. All positive samples can be correctly predicted, and all negative samples can also be correctly predicted.

[0059] When AUC <= 0.5, it means that the model's predictions are unable to distinguish between positive and negative samples;

[0060] When the AUC is between 0.5 and 1, the closer the AUC is to 1, the better the performance of the model, and it can more effectively distinguish positive and negative class samples; set the accuracy, recall, F1 value, ROC-AUC, and log loss thresholds, and when each metric reaches or exceeds the threshold, stop the training of the model.

[0061] Further, the step S300 includes:

[0062] Step S301: Real-time capture of user database operation requests, including the operation initiation time, the unique identity of the initiating user, and the operation instruction, and temporarily store the obtained information in a temporary storage area; read the operation instruction from the temporary storage area, parse the operation instruction through a SQL parsing tool, and extract the operation type, database target access resource, and operation conditions through parsing; at the same time, collect context information associated with the user operation, including user role and permission information, the IP of the terminal device currently used by the user for login, and the network environment information of the terminal device.

[0063] Step S302: Construct a real-time user behavior feature vector according to step S$200$, extract key features from the real-time captured operation request and context information, construct a real-time feature vector and perform preprocessing; input the preprocessed real-time feature vector into the trained permission prediction model, and the model outputs the prediction probability P of whether the user will access high-frequency resources, and set a probability threshold f, where f ∈ (0,1); if P >= f, query the user role access control list pre-set and stored in the database system, find the user's affiliated role according to the unique identifier of the user who initiated the request, and the preset permission information granted to the role for the current requested resource, and initially judge whether the user's current operation conforms to the normal permission range of the user by comparing the preset permission information with the type of the current operation request. If the preset permission includes the current operation type, it is determined that the permission range is met, and the hierarchical permission control process is triggered; if P < f, process the user's operation request according to the default permission configuration of the database system, and allow the user to operate with normal permissions.

[0064] Further, the step S400 includes:

[0065] Step S401: The database pre-defines different user roles, including ordinary users, advanced users, and administrators; each role has different responsibilities and permission scopes in the database; if it is predicted according to step S300 that the user will access high-frequency resources and it is initially determined that the user has permission, trigger hierarchical permission control; real-time obtain the concurrent access quantity of data resources.

[0066] Step S402: When the number of concurrent accesses to data resources is higher than the set concurrent threshold, set the upper limit of the single duration for ordinary users to access high-frequency resources; monitor the access time through the built-in timer, and automatically terminate the access connection once it times out, and pop up a window to remind the user; the single duration for advanced users to access high-frequency resources is limited to x minutes, and a warning pop-up window is sent to the user in advance to remind the user of the remaining access time; the database system will record the administrator's long-term operation behavior, and if the continuous access exceeds a hour, an email warning will be sent to the monitoring personnel to remind them to pay attention to whether the administrator's operation is abnormal; while performing hierarchical control on the user's access rights, a detailed hierarchical permission control notification is generated, and the notification content includes the user's current role, the number of concurrent accesses to the current data resource, the access rights granted to the user, and the validity period of the permission restriction.

[0067] A database resource management system based on authority control, the system includes a resource management module, a user behavior analysis module, a real-time authority determination module and a hierarchical authority control module;

[0068] The resource management module is used to collect database resource information and extract multi-dimensional features, classify database resources using clustering algorithms, and build a resource category identification system; collect user access operation information from the database management system log and store it in the operation log data warehouse, and screen out frequently accessed resources through statistical analysis;

[0069] The user behavior analysis module extracts user permission access related features from the operation log data warehouse and builds a permission prediction model based on user behavior in combination with the extracted database resource features;

[0070] The real-time permission determination module captures user operation requests in real time, combines context information, extracts and preprocesses real-time features related to permissions, and inputs them into the trained permission prediction model to predict whether the user will access high-frequency resources. At the same time, combined with the user role access control list set by the database system, it preliminarily determines whether the user's current operation is within the user's normal permission range;

[0071] If the hierarchical permission control module predicts that the user will access high-frequency resources and preliminarily determines that the user has permission, it triggers hierarchical permission control, and controls the user's access rights in a hierarchical manner according to the user role and the current usage of data resources, and sends a hierarchical permission control notification to the user accessing the high-frequency resources.

[0072] In an embodiment of the present invention, a database management system of a manufacturing enterprise is used as an example. This database stores a large amount of product design documents, production orders, supply chain information, employee files, and enterprise operation data. User roles within the enterprise include workshop workers, production supervisors, supply chain specialists, data analysts, IT administrators, etc.

[0073] First, we thoroughly traverse all data tables, views, and document resources in the database to extract multidimensional features. For example, the product_designs table stores information related to product design drawings, contains 10 fields, and contains 500,000 entries. Because some designs involve core technologies, the sensitivity label is set to 2. This table is associated with multiple department roles, and the permission correlation is 4. Based on historical modification records, we calculate that the data is highly dynamic. We then integrate these features to construct a resource feature vector.

[0074] At the same time, the DBSCAN clustering algorithm is used to classify resources. By calculating the Euclidean distance between resources and determining the appropriate neighborhood parameters, after cluster analysis, the product_designs table and its associated resources are classified as category 002 and stored in the resource classification table. The database management system collects employee operation logs in real time, covering the operation initiation time, employee ID, operation instructions, operation object, operation results, and the IP address of the terminal device that initiated the operation, and stores this information in the operation log data warehouse. The initial statistical period is set to 1 day, and the resource access frequency is calculated using the exponentially weighted moving average algorithm, combined with a 1-hour time window and a time decay factor of 0.3. By performing statistical analysis on historical access frequency data, calculating the mean and standard deviation, and setting the threshold to the mean plus 2 times the standard deviation, high-frequency access resources are screened out. During the new product development stage, the product_designs table was identified as a high-frequency access resource due to its frequent access.

[0075] Next, key information is extracted from the operation log data warehouse, including the operation timestamp, operation type, IP address of the terminal initiating the operation, and the operation result. This information is combined with the high-frequency identifiers of the resource and historical behavior data to construct a user behavior feature vector. Missing values ​​are processed for the extracted features, and outliers are identified and processed using box plots. The maximum-minimum normalization method is used to normalize the data to the interval [0,1]. The processed user behavior feature vector and resource feature vector are divided into training and test sets in a ratio of 8:2. The random forest algorithm is used to construct a dynamic permission prediction model. During the model construction process, the number of trees is set to 100, and the maximum depth H is set to 8. During model training, the training set is sampled with replacement, and each sub-dataset is used to construct a decision tree. For each node split, some features are randomly selected to find the optimal split method. The decision tree grows according to the CART algorithm until the tree depth reaches the maximum value. Finally, the model integrates the prediction results of multiple decision trees through majority voting and outputs the probability of the user accessing high-frequency resources.

[0076] When the production supervisor initiates an operation to view the details of new product designs in the product_designs table at 2024-03-26 14:30:00, the system captures the operation request, the employee's unique ID, the operation instruction, and the IP address of the terminal device initiating the operation in real time and temporarily stores them in a temporary storage area. The operation instruction is read from the temporary storage area and, using an SQL parsing tool, is parsed to determine that the operation type is a query, the database target resource is the product_designs table, and the operation condition is a filter condition related to new product designs. At the same time, contextual information is collected, including the IP address of the terminal device currently used by the employee to log in and the enterprise intranet environment information of the terminal device.

[0077] A real-time feature vector is constructed based on this information. After the same preprocessing steps as before, it is input into the trained permission prediction model, and the predicted probability is 0.6. The probability threshold f is pre-set to 0.5. Since 0.6>0.5, and the user role access control list pre-set and stored in the database system is queried, it is found that the production supervisor role has viewing permission for the product_designs table, so hierarchical permission control is triggered. At this time, it is monitored that the number of concurrent accesses to the product_designs table has reached 50, exceeding the pre-set concurrent threshold of 30. Hierarchical control is performed for different roles, and the upper limit of the single access time for ordinary workshop workers to high-frequency resources is set to 10 minutes. Through the built-in meter The timer monitors the access time. Once the timeout is reached, the access connection is automatically terminated and a pop-up window is displayed to the user. For advanced users such as senior data analysts, access to high-frequency resources is limited to 30 minutes at a time. When the remaining access time is 6 minutes, a warning pop-up window is displayed to the user in advance to remind the remaining access time. For administrators, if the access lasts for more than 2 hours, the system sends an email warning to the monitoring personnel, prompting them to pay attention to whether the administrator's operation is abnormal. At the same time, the system generates a detailed hierarchical permission control notification, which includes the user's current role (production supervisor), the number of concurrent accesses to the current data resource (50), the access rights granted to the user (view), and the validity period of the permission restriction (during this operation), and sends it to the production supervisor in the form of a pop-up window for reminder.

[0078] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above and that the invention can be embodied in other specific forms without departing from the spirit or essential characteristics of the invention. Therefore, the embodiments should be considered in all respects as illustrative and non-restrictive, and the scope of the invention is defined by the appended claims, not the foregoing description, and all variations within the meaning and range of equivalents of the claims are intended to be included therein. Any reference sign in a claim should not be construed as limiting the claim to which it relates.

Claims

1. A database resource management method based on authority control, characterized by: The method includes: Step S100: Collect database resource information and extract multi-dimensional features, classify database resources using a clustering algorithm, and construct a resource category identification system; collect user access operation information from the database management system log and store it in the operation log data warehouse, and through statistical analysis, screen out high-frequency access resources; Step S200: Extract features related to user permission access from the operation log data warehouse, and combine with the extracted database resource features to construct a permission prediction model based on user behavior; Step S300: Capture user operation requests in real time, combine with context information, extract and preprocess real-time features related to permissions, and input them into the trained permission prediction model to predict whether the user will access high-frequency resources; at the same time, combine with the user role access control list set by the database system to initially determine whether the user's current operation conforms to the normal permission range of the user; Step S301: Capture user database operation requests in real time, including the operation initiation time, the unique identity identifier of the initiating user, and the operation instruction, and temporarily store the obtained information in a temporary storage area; read the operation instruction from the temporary storage area, parse the operation instruction through an SQL parsing tool, and extract the operation type, the database target access resource, and the operation condition through parsing; at the same time, collect context information associated with the user operation, including user role and permission information, the IP of the terminal device currently used by the user for login, and the network environment information where the terminal device is located; Step S302: Construct a real-time user behavior feature vector according to Step S200, extract key features from the real-time captured operation requests and context information, construct a real-time feature vector and perform preprocessing; input the preprocessed real-time feature vector into the trained permission prediction model, and the model outputs the prediction probability P of whether the user will access high-frequency resources. Set a probability threshold f, f ∈ (0, 1); if P >= f, query the user role access control list preset and stored in the database system, find the user's affiliated role according to the unique identifier of the user who发起 the request, and the preset permission information assigned to the role for the current requested resource, and initially determine whether the user's current operation conforms to the normal permission range of the user by comparing the preset permission information with the type of the current operation request. If the preset permission includes the current operation type, it is determined that the permission range is met, and the hierarchical permission control process is triggered; if P < f, the user's operation request is processed according to the default permission configuration of the database system, and the user is allowed to operate with regular permissions; Step S400: If it is predicted that the user will access high-frequency resources and it is initially determined that the user has permission, trigger hierarchical permission control, control the user's access permissions hierarchically according to the user role and the current usage situation of the data resources, and at the same time send a hierarchical permission control notice to the user who accesses high-frequency resources; The said Step S400 includes: Step S401: The database system pre-defines different user roles, including ordinary users, advanced users, and administrators; if it is predicted according to Step S300 that the user will access high-frequency resources and it is initially determined that the user has permission, then trigger hierarchical permission control; Step S402: Acquire the number of concurrent accesses to data resources in real time. When the number of concurrent accesses to data resources is higher than the set concurrent threshold, set the upper limit of the single duration for ordinary users to access high-frequency resources to y minutes; monitor the access time through the built-in timer. Once it times out, the access connection is automatically terminated and a pop-up window is displayed to the user; the single duration for advanced users to access high-frequency resources is limited to x minutes, and when the remaining access time is 0.2x minutes, a warning pop-up window is displayed to the user in advance to remind the remaining access time; the database system records the administrator's long-term operation behavior. If the continuous access exceeds a hour, an email warning is sent to the monitoring personnel, prompting them to pay attention to whether the administrator's operation is abnormal; while performing hierarchical control on the user's access rights, a detailed hierarchical permission control notification is generated. The notification content includes the user's current role, the number of concurrent accesses to the current data resource, the access rights granted to the user, and the validity period of the permission restriction.

2. The database resource management method based on authority control according to claim 1, characterized in that: The step S100 includes: Step S101: Traverse all resources in the database, including various data tables, views, and storage locations; for each resource, extract multidimensional metadata information, including table name, field type, data volume, access user role and corresponding permissions, resource modification time, and predefined sensitivity labels; the sensitivity labels include three categories: public, internal, and confidential; for each resource, construct a resource feature vector Ri=[ri1, ri2, ri3], where Ri represents the feature vector of the i-th database resource, ri1 represents the data sensitivity of the i-th database resource, ri2 represents the permission association of the i-th database resource, and ri3 represents the data dynamics of the i-th database resource; the data sensitivity is labeled according to the set business rules, 0 represents public data, 1 represents internal data, and 2 represents confidential data; the permission association is used to count the number of user roles associated with accessing the resource; the data dynamics is used to calculate the number of days between the last modification time of the resource and the current time; Step S102: Use the DBSCAN clustering algorithm to classify database resources, calculate the Euclidean distance between resource feature vectors, determine the nearest neighbor distance dmin of each resource feature vector, summarize the nearest neighbor distances of all resource feature vectors, and draw a distance graph, where the horizontal axis is the data point index and the vertical axis is the nearest neighbor distance of the corresponding point. Connect the points in the order of the data point index to form a curve, and select the distance value corresponding to the first inflection point on the curve as the neighborhood radius e; define the minimum number of neighborhood points Mp, and determine the core points, boundary points, and noise points based on e and Mp; if the resource feature vector Ri If the nearest neighbor distance dmin is less than or equal to e, and the number of points contained in its neighborhood is at least Mp, then Ri is a core point; if Ri is not a core point, but Ri's neighborhood e contains at least one core point, then Ri is a boundary point; if Ri is neither a core point nor a boundary point, then Ri is a noise point; divide the core point and the points in its neighborhood into different clusters, each cluster represents a database resource category; build a resource category classification system, assign a unique identifier to each category, establish a mapping relationship between resources and classification identifiers, and store the resource's unique identifier and the corresponding classification identifier in the resource classification table of the database; Step S103: The database management system collects user access information, including operation timestamp, operation type, database resources involved, IP address of the terminal initiating the operation, and operation results, and stores the information in the operation log data warehouse; an initial statistical period is defined, and the total number of resource accesses within the statistical period is divided by the number of time units within the period to obtain the average number of accesses as the initial access frequency F0; an exponentially weighted moving average algorithm is used, and the time window is set to a fixed length T. The calculation formula is F t =α×A t + (1-α) × F t-1 , where F t is the access frequency of the resource at the current moment, A t is the actual number of resource accesses in the current time window T, α is the time decay factor where 0<α<1, F t-1 is the access frequency of the resource at the last moment, and F is the initial calculation frequency. t-1 =F0; set an access frequency threshold β, and set F t Resources greater than or equal to β are screened out as high-frequency access resources; by performing statistical analysis on historical access frequency data, the mean and standard deviation are calculated, and the threshold β is set to the mean plus k times the standard deviation, where k is the coefficient for adjusting the threshold.

3. The database resource management method based on authority control according to claim 1, characterized in that: The step S200 includes: Step S201: Extract features related to user access rights from the operation log data warehouse, including the operation timestamp, operation type, involved database resources, IP address of the terminal initiating the operation, and operation results. Simultaneously, extract the feature "whether it is a high-frequency resource" from the high-frequency access resource information filtered out in step S100. Extract key features from the collected historical behavior data to construct a user behavior feature vector U = [operation timestamp, operation type, IP address of the terminal initiating the operation, operation result, access frequency, whether it is an access to a high-frequency resource]. Perform missing value processing, outlier processing, and data normalization on the extracted features. Construct a target label for the model. If the operation record involves a high-frequency resource, the label is set to 1; if not, the label is set to 0. Step S202: Divide the collected user behavior data and the database resource data in step S100 into a training set and a test set in a ratio of 8:2, and use the random forest algorithm to build a dynamic permission prediction model, with the user behavior feature vector U and the resource feature vector Ri as input; set the parameters of the random forest algorithm, including the number of trees and the maximum depth, and use the cross-validation method to evaluate and optimize the model. During the training process, continuously adjust the model parameters; the model outputs the probability of users accessing high-frequency resources, using accuracy, recall rate, F1 value, ROC-AUC and logarithmic loss as evaluation indicators.

4. A database resource management system based on authority control, applied to a database resource management method based on authority control according to any one of claims 1 to 3, characterized in that: The system includes a resource management module, a user behavior analysis module, a real-time authority determination module and a hierarchical authority control module; The resource management module is used to collect database resource information and extract multi-dimensional features, classify database resources using clustering algorithms, and build a resource category identification system; collect user access operation information from the database management system log and store it in the operation log data warehouse, and screen out frequently accessed resources through statistical analysis; The user behavior analysis module extracts user permission access related features from the operation log data warehouse and builds a permission prediction model based on user behavior in combination with the extracted database resource features; The real-time permission determination module captures user operation requests in real time, combines context information, extracts and preprocesses real-time features related to permissions, and inputs them into the trained permission prediction model to predict whether the user will access high-frequency resources. At the same time, combined with the user role access control list set by the database system, it preliminarily determines whether the user's current operation is within the user's normal permission range; If the hierarchical permission control module predicts that the user will access high-frequency resources and preliminarily determines that the user has permission, it triggers hierarchical permission control, and controls the user's access rights in a hierarchical manner according to the user role and the current usage of data resources, and sends a hierarchical permission control notification to the user accessing the high-frequency resources.

5. A database resource management system based on authority control according to claim 4, characterized in that: The resource management module includes a resource information collection unit and a high-frequency resource screening unit; the resource information collection unit is used to traverse the database and collect multidimensional metadata of various resources; at the same time, user access operation information is collected in the database management system and stored in the operation log data warehouse; the DBSCAN clustering algorithm is used to complete resource classification based on the Euclidean distance of resource feature vectors and construct a resource category identification system; the high-frequency resource screening unit screens out high-frequency access resources based on the defined initial statistical period, combined with the exponentially weighted moving average algorithm, and the time window and attenuation factor.

6. A database resource management system based on authority control according to claim 4, characterized in that: The user behavior analysis module includes a behavior data collection unit and a permission model construction unit; the behavior data collection unit extracts permission-related features from the operation log data warehouse, integrates high-frequency resource-related features, constructs a user behavior feature vector, and performs missing value and outlier processing and normalization on the extracted features; The permission model construction unit divides the user behavior data and the database resource data into a training set and a test set in proportion, adopts a random forest algorithm, and inputs the processed feature vector to construct a dynamic permission prediction model.

7. A database resource management system based on authority control according to claim 4, characterized in that: The real-time permission determination module includes an operation behavior parsing unit and a permission determination execution unit; the operation behavior parsing unit captures user database operation requests in real time, parses operation instructions, extracts user operation and database resource information, and synchronously collects operation context information; The permission discrimination execution unit constructs and pre-processes the real-time feature vector according to the permission model construction module, inputs the trained model to predict the probability of users accessing high-frequency resources and compares it with the threshold; Based on the probability comparison results and combined with the user role access control list, determine whether the operation permissions are compliant. If they are compliant, hierarchical permission control is triggered.

8. The database resource management system based on authority control according to claim 4, characterized in that: The hierarchical authority control module monitors the number of concurrent accesses to data resources in real time, limits the access time of each role according to different user roles and authority ranges, and provides hierarchical control prompts.

Images