Permission hierarchical control method and operation and maintenance bastion system based on dynamic desensitization and real-time monitoring

Abstract

An embodiment of the present invention discloses a permission hierarchical control method and an operation and maintenance bastion host system based on dynamic desensitization and real-time monitoring. The embodiment of the present invention significantly improves data security and operational compliance in operation and maintenance scenarios by integrating a database firewall and a dual-mode desensitization engine, combining permission hierarchical control and real-time semantic analysis. Dynamic desensitization rewrites query statements in real time according to user roles to limit the exposure of original data; static desensitization pre-generates isolated copies to reduce direct access to production libraries; based on semantic analysis and rule engines, the response time is shortened to within 1 second; the static desensitization library supports direct use in development and testing, reducing the permission application process; and the rule library is dynamically updated through the Attention-GRU-Adaboost model to improve adaptability to new attack patterns.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of information security technology, and specifically to a permission hierarchical control method and an operation and maintenance bastion host system based on dynamic desensitization and real-time monitoring. Background Art

[0002] An Operation Bastion Host (OBH) is a core device in the information security field, primarily used to centrally manage and control access by O&M personnel to critical infrastructure such as databases and servers. Its core functions include permission management, access control, operation auditing, and session recording. It authenticates and authorizes O&M operations through a unified portal, ensuring traceability. Traditional O&M bastion hosts typically employ a static permission allocation mechanism, pre-setting fixed permission ranges based on roles and using logging to audit operational compliance post-hoc. Furthermore, some systems support basic data desensitization, which masks or replaces sensitive fields (such as ID numbers and mobile phone numbers) before data storage to reduce the risk of data leakage.

[0003] Although existing O&M bastion hosts have improved O&M security to a certain extent, they still have the following significant issues:

[0004] 1) Extensive permission control can easily lead to permission overload: Operations and maintenance personnel are often granted access rights that exceed actual needs. For example, ordinary operations and maintenance roles can have unlimited access to sensitive data tables, increasing the risk of internal data abuse.

[0005] 2) Static desensitization lacks flexibility: Traditional desensitization technologies process static copies of data only during the data storage phase, and are unable to dynamically adjust desensitization strategies based on real-time business scenarios (such as different user roles and query requirements). For example, when developers need to access test data, they still need to rely on static desensitized copies of the production database, making it difficult to achieve "on-demand desensitization."

[0006] 3) Delayed Detection of Illegal Operations: Existing systems rely on manual audit logs or scheduled scanning rule matching, unable to intercept high-risk operations (such as batch data exports during non-business hours and abnormally high-frequency queries) in real time. This lag often means that security responses are often initiated only after a data breach occurs, making it difficult to implement proactive prevention measures. Summary of the Invention

[0007] To this end, an embodiment of the present invention provides a permission hierarchical control method and an operation and maintenance bastion host system based on dynamic desensitization and real-time monitoring to solve the technical problems of permission overload, insufficient static desensitization and delayed violation monitoring in the existing technology.

[0008] In order to achieve the above objectives, the embodiments of the present invention provide the following technical solutions:

[0009] According to a first aspect of an embodiment of the present invention, a method for hierarchical permission control based on dynamic desensitization and real-time monitoring is provided. The method is applied to a database firewall and includes:

[0010] Obtain all operation and maintenance roles and classify the permissions of the operation and maintenance roles into three levels: primary, advanced, and special.

[0011] After detecting an SQL query request, intercept the SQL query request and obtain the current operation and maintenance role and corresponding authority level. Use the authority level to dynamically rewrite the SQL statement to perform differential desensitization on sensitive fields. After desensitization, the production database returns the desensitized results to the operation and maintenance personnel terminal.

[0012] Capture operation logs in real time and use operational semantic analysis and machine learning models to detect illegal operations in real time, trigger blocking or alarms based on risk levels, and dynamically update the risk rule library.

[0013] Furthermore, the permissions are divided into three levels: primary, advanced and special, including:

[0014] Primary authority: only has the authority to perform static desensitization; Advanced authority: has the authority to perform dynamic desensitization and audit; Special authority: has emergency temporary authority.

[0015] Furthermore, the static desensitization includes:

[0016] Pre-generate static desensitized copies of high-risk data tables and desensitized copy databases for direct access by low-privilege users;

[0017] The desensitized copy database is isolated from the production database, and reverse association with the original data is prohibited.

[0018] Furthermore, after detecting an SQL query request, the SQL query request is intercepted and the current operation and maintenance role and corresponding authority level are obtained. The SQL statement is dynamically rewritten using the authority level to perform differential desensitization on sensitive fields. After desensitization, the production database returns the desensitization result to the operation and maintenance personnel terminal, including:

[0019] The operation and maintenance personnel terminal initiates an SQL query request to the database firewall. After receiving the SQL query request, the database firewall detects the user's permissions through the rule engine, and the rule engine returns the desensitization rules to the database firewall;

[0020] After receiving the desensitization rule, the database firewall sends a request to the production database to execute the desensitization rule;

[0021] After the desensitization rules are executed, the desensitization results will be returned to the operation and maintenance personnel terminal.

[0022] Furthermore, the differentiated desensitization is to replace sensitive fields in SQL queries with masks or hash values ​​according to user roles.

[0023] Furthermore, the operational semantic analysis includes:

[0024] Analyze the operation type, execution time and data volume of SQL statements;

[0025] Identify batch exports and high-frequency sensitive field query behaviors during non-working hours.

[0026] Furthermore, the system captures operation logs in real time and uses operational semantic analysis and machine learning models to detect illegal operations in real time, triggering blocking or alarming based on risk levels and dynamically updating the risk rule base, including:

[0027] Capture operation logs and perform rule matching on the current operation logs to determine whether the current operation logs match the preset rules;

[0028] If the preset rules are matched, an alarm is triggered and blocking is performed;

[0029] If the preset rules are not matched, the machine learning model is used for analysis to obtain an anomaly score and determine whether the anomaly score is greater than a preset threshold;

[0030] If it is greater than the preset threshold, a new rule is dynamically added and the current operation is blocked; if it is a normal operation, it is released.

[0031] Furthermore, the machine learning model is an Attention-GRU-Adaboost model, which introduces the attention mechanism into the GRU network and integrates the Attention-GRU model through the Adaboost algorithm.

[0032] According to a second aspect of an embodiment of the present invention, an operation and maintenance bastion host system based on dynamic desensitization and real-time monitoring is provided. The system comprises an operation and maintenance bastion host, a database firewall, and a rule engine, and specifically includes:

[0033] The operation and maintenance bastion host is used to obtain all operation and maintenance roles and classify the permissions of the operation and maintenance roles into three levels: primary, advanced, and special.

[0034] The database firewall is used to intercept SQL query requests after detecting them and obtain the current operation and maintenance role and corresponding authority level;

[0035] The rule engine is used to dynamically rewrite SQL statements using the permission levels to perform differentiated desensitization on sensitive fields. After desensitization, the production database returns the desensitization results to the operation and maintenance personnel terminal.

[0036] Furthermore, the system further includes an audit module for performing the following steps:

[0037] Capture operation logs in real time and use operational semantic analysis and machine learning models to detect illegal operations in real time, trigger blocking or alarms based on risk levels, and dynamically update the risk rule library.

[0038] The embodiments of the present invention have the following advantages:

[0039] The embodiment of the present invention significantly improves data security and operational compliance in operation and maintenance scenarios by integrating a database firewall and a dual-mode desensitization engine, combining permission hierarchical control and real-time semantic analysis. Dynamic desensitization rewrites query statements in real time according to user roles to limit the exposure of original data; static desensitization pre-generates isolated copies to reduce direct access to production libraries; based on semantic analysis and rule engines, the response time is shortened to within 1 second, achieving "pre-emptive defense"; the static desensitization library supports direct use in development and testing, reducing the permission application process; the rule library is dynamically updated through the Attention-GRU-Adaboost model to improve adaptability to new attack patterns. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] To more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for the embodiments or the description of the prior art. Obviously, the drawings described below are merely exemplary, and those skilled in the art can derive other implementation drawings based on the provided drawings without inventive effort.

[0041] The structures, proportions, sizes, etc. illustrated in this specification are intended only to complement the contents disclosed herein and to facilitate understanding and reading by persons familiar with the art. They are not intended to limit the conditions under which the present invention may be implemented and therefore have no substantive technical significance. Any structural modifications, changes in proportions, or adjustments in sizes, without affecting the efficacy and objectives of the present invention, shall still fall within the scope of the technical contents disclosed herein.

[0042] Figure 1 A schematic diagram of the logical structure of an operation and maintenance bastion host system based on dynamic desensitization and real-time monitoring provided by an embodiment of the present invention;

[0043] Figure 2 A flowchart of a method for hierarchical permission control based on dynamic desensitization and real-time monitoring provided by an embodiment of the present invention;

[0044] Figure 3 A schematic diagram of a dynamic desensitization process in a method for hierarchical permission control based on dynamic desensitization and real-time monitoring provided by an embodiment of the present invention;

[0045] Figure 4 A schematic diagram of a violation detection process in a permission hierarchical control method based on dynamic desensitization and real-time monitoring provided by an embodiment of the present invention;

[0046] Figure 5 A schematic diagram of the relevant components of an operation and maintenance bastion host system based on dynamic desensitization and real-time monitoring provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0047] The following describes the implementation of the present invention using specific embodiments. Those skilled in the art will readily understand the other advantages and benefits of the present invention from the disclosure herein. Obviously, the embodiments described are only a portion of the present invention, not all of it. All other embodiments derived by persons of ordinary skill in the art based on the embodiments of the present invention without inventive effort are intended to fall within the scope of protection of the present invention.

[0048] An Operation Bastion Host (OBH) is a core device in the information security field, primarily used to centrally manage and control access by O&M personnel to critical infrastructure such as databases and servers. Its core functions include permission management, access control, operation auditing, and session recording. It authenticates and authorizes O&M operations through a unified portal, ensuring traceability. Traditional O&M bastion hosts typically employ a static permission allocation mechanism, pre-setting fixed permission ranges based on roles and using logging to audit operational compliance post-hoc. Furthermore, some systems support basic data desensitization, which masks or replaces sensitive fields (such as ID numbers and mobile phone numbers) before data storage to reduce the risk of data leakage.

[0049] Although existing O&M bastion hosts have improved O&M security to a certain extent, they still have the following significant issues:

[0050] 1) Extensive permission control can easily lead to permission overload: Operations and maintenance personnel are often granted access rights that exceed actual needs. For example, ordinary operations and maintenance roles can have unlimited access to sensitive data tables, increasing the risk of internal data abuse.

[0051] 2) Static desensitization lacks flexibility: Traditional desensitization technologies process static copies of data only during the data storage phase, and are unable to dynamically adjust desensitization strategies based on real-time business scenarios (such as different user roles and query requirements). For example, when developers need to access test data, they still need to rely on static desensitized copies of the production database, making it difficult to achieve "on-demand desensitization."

[0052] 3) Delayed Detection of Illegal Operations: Existing systems rely on manual audit logs or scheduled scanning rule matching, unable to intercept high-risk operations (such as batch data exports during non-business hours and abnormally high-frequency queries) in real time. This lag often means that security responses are often initiated only after a data breach occurs, making it difficult to implement proactive prevention measures.

[0053] In order to solve the technical problems of the above-mentioned existing technologies that are prone to permission overload, insufficient static desensitization and delayed violation monitoring.

[0054] refer to Figure 1 The embodiment of the present invention discloses an operation and maintenance bastion host system based on dynamic desensitization and real-time monitoring, and the system is composed of an operation and maintenance bastion host, a database firewall and a rule engine, specifically including: the operation and maintenance bastion host is used to obtain all operation and maintenance roles and classify the permissions of the operation and maintenance roles, and the permission classification is divided into three levels: primary, advanced and special permissions; the database firewall is used to intercept the SQL query request after detecting the SQL query request and obtain the current operation and maintenance role and the corresponding permission level; the rule engine is used to use the permission level to dynamically rewrite the SQL statement to perform differentiated desensitization on sensitive fields. After desensitization, the production database returns the desensitized result to the operation and maintenance personnel terminal.

[0055] Furthermore, the system also includes an audit module for performing the following steps: capturing operation logs in real time and using operational semantic analysis and machine learning models to detect illegal operations in real time, triggering blocking or alarms based on risk levels, and dynamically updating the risk rule library.

[0056] In the embodiment of the present invention, Figure 5 For example, the operation and maintenance bastion machine establishes communication with the database firewall, and the database firewall controls the desensitization processing module, the dynamic access control unit, the real-time monitoring module and the audit tracking module respectively.

[0057] Among them, the desensitization processing module and the dynamic access control unit are used to protect sensitive data in the sensitive database and realize a dual-mode desensitization engine.

[0058] The real-time monitoring module monitors user operations in real time through the AI ​​anomaly detection model and detects violations in real time through the audit tracking module and audit log library.

[0059] Corresponding to the above-disclosed operation and maintenance bastion host system based on dynamic desensitization and real-time monitoring, an embodiment of the present invention further discloses a method for hierarchical permission control based on dynamic desensitization and real-time monitoring. The following describes in detail a method for hierarchical permission control based on dynamic desensitization and real-time monitoring disclosed in an embodiment of the present invention, in conjunction with the above-described operation and maintenance bastion host system based on dynamic desensitization and real-time monitoring.

[0060] refer to Figure 2The present invention discloses a permission hierarchical control method based on dynamic desensitization and real-time monitoring, which is applied to a database firewall and includes: obtaining all operation and maintenance roles and grading the permissions of the operation and maintenance roles, wherein the permission grading is divided into three levels: primary, advanced and special; after detecting an SQL query request, intercepting the SQL query request and obtaining the current operation and maintenance role and the corresponding permission level, dynamically rewriting the SQL statement using the permission level to perform differentiated desensitization on sensitive fields, and after desensitization, the production database returns the desensitization result to the operation and maintenance personnel terminal; capturing operation logs in real time and using operational semantic analysis and machine learning models to perform real-time detection of illegal operations, triggering blocking or alarming according to the risk level and dynamically updating the risk rule library.

[0061] Furthermore, the authority classification is divided into three levels: primary, advanced and special, including: primary authority: only has the authority to perform static desensitization, advanced authority: has dynamic desensitization authority and audit authority, and privileged: has emergency temporary authority.

[0062] Furthermore, the static desensitization includes: pre-generating a static desensitized copy of the high-risk data table and a desensitized copy database for direct access by low-authority users.

[0063] The desensitized copy database is isolated from the production database, and reverse association with the original data is prohibited.

[0064] Further, refer to Figure 3 After detecting the SQL query request, intercept the SQL query request and obtain the current operation and maintenance role and the corresponding authority level, use the authority level to dynamically rewrite the SQL statement to perform differentiated desensitization on the sensitive fields, and after desensitization, the production database returns the desensitized result to the operation and maintenance personnel terminal, including: the operation and maintenance personnel terminal initiates an SQL query request to the database firewall, and the database firewall detects the user authority through the rule engine after receiving the SQL query request, and the rule engine returns the desensitization rule to the database firewall; after receiving the desensitization rule, the database firewall sends a request to the production database to execute the desensitization rule; after the desensitization rule is executed, the desensitization result is returned to the operation and maintenance personnel terminal.

[0065] Example of a violation rule base:

[0066] Rule 1: If the number of rows returned by a single query is > 1000, manual review is triggered.

[0067] Rule 2: Data export is performed between 1:00 AM and 5:00 AM → Automatically blocked.

[0068] Furthermore, the differentiated desensitization is to replace sensitive fields in SQL queries with masks or hash values ​​according to user roles.

[0069] Desensitization rule configuration example:

[0070] -- Raw SQL

[0071] SELECT * FROM user_table WHERE id=1001;

[0072] -- After dynamic rewriting (primary role)

[0073] SELECT name, CONCAT('***', RIGHT(phone,4)) FROM user_table WHERE id=1001;

[0074] Furthermore, the operational semantic analysis includes: parsing the operation type, execution time and data volume of SQL statements; identifying batch exports during non-working hours and high-frequency sensitive field query behaviors.

[0075] Further, refer to Figure 4 , capture operation logs in real time and use operation semantic analysis and machine learning models to detect illegal operations in real time, trigger blocking or alarm according to the risk level and dynamically update the risk rule library, including: capturing operation logs and matching rules on the current operation logs to determine whether the current operation logs match the preset rules; if the preset rules are matched, an alarm is triggered and blocking is performed; if the preset rules are not matched, the machine learning model is used for analysis to obtain an anomaly score and determine whether the anomaly score is greater than the preset threshold; if it is greater than the preset threshold, new rules are dynamically added and the current operation is blocked; if it is a normal operation, it is released.

[0076] GRU (Gate Recurrent Unit): A type of recurrent neural network (RNN). Like LSTM (Long-Short Term Memory), it was developed to address issues such as long-term memory dependency and vanishing gradients in backpropagation. Compared to LSTM, GRU can achieve comparable results and is easier to train.

[0077] The attention mechanism is a neural network technique that allows the network to focus on the most important parts of an input sequence. In an attention-based GRU network, attention weights are introduced into the GRU unit to measure the importance of each element in the input sequence. This attention weighting allows the network to focus more on features that are critical to the classification task, thereby improving classification accuracy.

[0078] The Adaboost algorithm is an ensemble learning algorithm that generates a strong classifier by weightedly combining multiple weak classifiers. In the Adaboost algorithm, each weak classifier in the training set is assigned a different weight, and weak classifiers with larger weights have a greater influence on the final decision. The Adaboost algorithm can effectively improve the overall performance and robustness of the classifier.

[0079] Furthermore, the machine learning model is an Attention-GRU-Adaboost model, which introduces the attention mechanism into the GRU network and integrates the Attention-GRU model through the Adaboost algorithm.

[0080] Introducing the attention mechanism into the GRU network and integrating the Attention-GRU model through the Adaboost algorithm include:

[0081] 1) Data preprocessing:

[0082] Normalize and standardize the input data to ensure that the data is distributed in a similar range.

[0083] 2) Attention-GRU model training:

[0084] Introducing the attention mechanism into the GRU network to train the Attention-GRU model. During training, the model parameters are updated through the backpropagation algorithm, enabling the model to learn the attention weights of important features in the input sequence.

[0085] Weak classifier generation: Train multiple Attention-GRU models, each trained on a different subset of the training set. These Attention-GRU models serve as weak classifiers.

[0086] 3) Adaboost Ensemble:

[0087] According to the Adaboost algorithm, weak classifiers are weighted and combined to generate a strong classifier. Weak classifiers with larger weights have greater influence in the final decision.

[0088] 4) Classification:

[0089] Use the strong classifier to classify new data.

[0090] The core innovation of the embodiment of the present invention is database firewall integration: before the operation and maintenance request reaches the database, it is intercepted by the firewall and dynamically desensitized; dual-mode desensitization engine: dynamic desensitization: real-time rewriting of query statements according to user roles (such as replacing sensitive fields with hash values); static desensitization: pre-generate desensitized copies of high-risk assets (such as user tables) for access by low-privilege users; real-time discovery of illegal business: based on operational semantic analysis, identify abnormal behavior (such as batch export during non-working hours); combined with machine learning models, dynamically update the risk rule library.

[0091] The embodiments of the present invention have the following advantages:

[0092] 1) Dynamic desensitization limits the exposure of raw data, reducing the risk of data leakage by 80%;

[0093] 2) Leveraging a real-time rules engine and semantic analysis algorithm, the response time for illegal operations is less than 1 second;

[0094] 3) The static desensitization library supports direct use in development / testing without applying for production permissions, effectively improving operation and maintenance efficiency.

[0095] Although the present invention has been described in detail above using general descriptions and specific embodiments, it will be apparent to those skilled in the art that modifications and improvements may be made thereto. Therefore, such modifications and improvements, without departing from the spirit of the present invention, are intended to be within the scope of protection claimed herein.

Claims

1. A method for hierarchical authority control based on dynamic desensitization and real-time monitoring, characterized in that: The method is applied to a database firewall and includes: Obtain all operation and maintenance roles and classify the permissions of the operation and maintenance roles into three levels: primary, advanced, and special. After detecting an SQL query request, intercept the SQL query request and obtain the current operation and maintenance role and corresponding authority level. Use the authority level to dynamically rewrite the SQL statement to perform differential desensitization on sensitive fields. After desensitization, the production database returns the desensitized results to the operation and maintenance personnel terminal. Capture operation logs in real time and use operational semantic analysis and machine learning models to detect illegal operations in real time, trigger blocking or alarming based on risk levels, and dynamically update the risk rule library; The authority levels are divided into three levels: primary, advanced and special, including: Primary authority: only has the authority to perform static desensitization; Advanced authority: has the authority to perform dynamic desensitization and audit; Special authority: has emergency temporary authority; The static desensitization comprises: Pre-generate static desensitized copies of high-risk data tables and desensitized copy databases for direct access by low-privilege users; The desensitized copy database is isolated from the production database, and reverse association with the original data is prohibited; After detecting an SQL query request, intercept the SQL query request and obtain the current operation and maintenance role and corresponding authority level. Use the authority level to dynamically rewrite the SQL statement to perform differential desensitization on sensitive fields. After desensitization, the production database returns the desensitization results to the operation and maintenance personnel terminal, including: The operation and maintenance personnel terminal initiates an SQL query request to the database firewall. After receiving the SQL query request, the database firewall detects the user's permissions through the rule engine, and the rule engine returns the desensitization rules to the database firewall; After receiving the desensitization rule, the database firewall sends a request to the production database to execute the desensitization rule; After the desensitization rules are executed, the desensitization results are returned to the operation and maintenance personnel terminal; The machine learning model is an Attention-GRU-Adaboost model, which introduces the attention mechanism into the GRU network and integrates the Attention-GRU model through the Adaboost algorithm.

2. The method for hierarchical authority control based on dynamic desensitization and real-time monitoring according to claim 1, characterized in that: The differentiated desensitization is to replace sensitive fields in SQL queries with masks or hash values ​​based on user roles.

3. The method for hierarchical authority control based on dynamic desensitization and real-time monitoring according to claim 1, characterized in that: The operational semantic analysis includes: Analyze the operation type, execution time and data volume of SQL statements; Identify batch exports and high-frequency sensitive field query behaviors during non-working hours.

4. The method for hierarchical authority control based on dynamic desensitization and real-time monitoring according to claim 1, characterized in that: Capture operation logs in real time and use operational semantic analysis and machine learning models to detect illegal operations in real time, trigger blocking or alarming based on risk levels, and dynamically update the risk rule base, including: Capture operation logs and perform rule matching on the current operation logs to determine whether the current operation logs match the preset rules; If the preset rules are matched, an alarm is triggered and blocking is performed; If the preset rules are not matched, the machine learning model is used for analysis to obtain an anomaly score and determine whether the anomaly score is greater than a preset threshold; If it is greater than the preset threshold, a new rule is dynamically added and the current operation is blocked; if it is a normal operation, it is released.

5. An operation and maintenance bastion host system based on dynamic desensitization and real-time monitoring, characterized in that: The system consists of an operation and maintenance bastion host, a database firewall, and a rule engine, specifically including: The operation and maintenance bastion host is used to obtain all operation and maintenance roles and classify the permissions of the operation and maintenance roles into three levels: primary, advanced, and special. The database firewall is used to intercept SQL query requests after detecting them and obtain the current operation and maintenance role and corresponding authority level; The rule engine is used to dynamically rewrite SQL statements using the permission levels to perform differentiated desensitization on sensitive fields. After desensitization, the production database returns the desensitization results to the operation and maintenance personnel terminal; The system further includes an audit module for performing the following steps: Capture operation logs in real time and use operational semantic analysis and machine learning models to detect illegal operations in real time, trigger blocking or alarming based on risk levels, and dynamically update the risk rule library; The authority levels are divided into three levels: primary, advanced and special, including: Primary authority: only has the authority to perform static desensitization; Advanced authority: has the authority to perform dynamic desensitization and audit; Special authority: has emergency temporary authority; The static desensitization comprises: Pre-generate static desensitized copies of high-risk data tables and desensitized copy databases for direct access by low-privilege users; The desensitized copy database is isolated from the production database, and reverse association with the original data is prohibited; After detecting an SQL query request, intercept the SQL query request and obtain the current operation and maintenance role and corresponding authority level. Use the authority level to dynamically rewrite the SQL statement to perform differential desensitization on sensitive fields. After desensitization, the production database returns the desensitization results to the operation and maintenance personnel terminal, including: The operation and maintenance personnel terminal initiates an SQL query request to the database firewall. After receiving the SQL query request, the database firewall detects the user's permissions through the rule engine, and the rule engine returns the desensitization rules to the database firewall; After receiving the desensitization rule, the database firewall sends a request to the production database to execute the desensitization rule; After the desensitization rules are executed, the desensitization results are returned to the operation and maintenance personnel terminal; The machine learning model is an Attention-GRU-Adaboost model, which introduces the attention mechanism into the GRU network and integrates the Attention-GRU model through the Adaboost algorithm.

Images