Operation log auditing management method and system

Abstract

The invention discloses an operation log auditing management method and system. The method comprises the steps of obtaining a to-be-processed first operation log from a target database; determining sensitivity-related marks corresponding to the first operation records based on a predefined sensitivity-related database; under the condition that the sensitivity-related mark of a first target operation record in the multiple first operation records contains the sensitivity-related data, determining the sensitivity-related level of the sensitivity-related data contained in the first target operation record, and analyzing the first target operation record and the corresponding sensitivity-related level by using a responsible person prediction model, obtaining a first predicted person in charge corresponding to the first target operation record; and distributing the first target operation record to the corresponding first predicted responsible person for auditing confirmation. According to the method and the device, the technical problems of relatively low efficiency and relatively poor accuracy caused by manually auditing and confirming sensitive information in massive operation records are solved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and more specifically, to an operation log audit management method and system. Background Art

[0002] In the era of big data, businesses generate hundreds of millions of data records daily. These records contain not only a vast amount of non-sensitive information but also highly sensitive data such as customer privacy and business secrets. For the telecommunications industry, sensitive data such as customer names, ID numbers, and call logs must be strictly protected. However, with the surge in data volume, relying solely on manual review is becoming increasingly difficult. Manual review consumes significant time and human resources. Furthermore, due to the limitations of human recognition and the potential for human error, false positives or omissions of sensitive information are common. This not only adds additional costs but also creates the potential for data leakage or misuse.

[0003] To address the above-mentioned problems, no effective solutions have been proposed so far. Summary of the Invention

[0004] The embodiments of the present application provide an operation log audit management method and system to at least solve the technical problem of low efficiency and poor accuracy caused by manual auditing and confirmation of sensitive information in massive operation records.

[0005] According to one aspect of an embodiment of the present application, an operation log audit management method is provided, comprising: obtaining a first operation log to be processed from a target database, wherein the first operation log includes multiple first operation records; determining sensitive tags corresponding to each of the multiple first operation records based on a predefined sensitive database, wherein the sensitive database includes sensitive data of different sensitivity levels, and the sensitive tag is used to reflect whether the first operation record contains sensitive data; when the sensitive tag of a first target operation record among the multiple first operation records indicates that it contains sensitive data, determining the sensitivity level of the sensitive data contained in the first target operation record, and using a pre-trained responsible person prediction model to analyze the first target operation record and the corresponding sensitive level to obtain a first predicted responsible person corresponding to the first target operation record; and allocating the first target operation record to the corresponding first predicted responsible person for audit confirmation.

[0006] Optionally, based on a predefined sensitive database, determining the sensitive tags corresponding to each of the multiple first operation records includes: determining a first hash value of the first operation log, and obtaining a second hash value of the second operation log at the last processing target database; when the first hash value is different from the second hash value, determining at least one new first operation record in the first operation log compared to the second operation log; and determining a sensitive tag for each new first operation record in the first operation log based on the sensitive database.

[0007] Optionally, the first operation record includes an operation object and corresponding data lineage characteristics, and the data lineage characteristics include at least one of the following: data type, activation status, table name, column name, database account, wherein the sensitive tag of each newly added first operation record in the first operation log is determined based on the sensitive database, including: for each newly added first operation record, matching the data lineage characteristics in the newly added first operation record with the sensitive database; when the matching result is a successful match, determining the sensitive tag of the newly added first operation record as containing sensitive data; when the matching result is a failed match, determining the sensitive tag of the newly added first operation record as not containing sensitive data.

[0008] Optionally, the training process of the responsible person prediction model includes: obtaining multiple groups of training sample data, wherein each group of training sample data includes: the feature vector of the second operation record, and the second actual responsible person who audits and confirms the second operation record; constructing a deep learning model; for each group of training samples, inputting the second operation record in the training sample into the deep learning model to obtain the second predicted responsible person output by the deep learning model; constructing a target loss function based on the second actual responsible person and the second predicted responsible person in each group of training samples, and optimizing the target loss function until the preset convergence conditions are met, thereby obtaining a completed trained responsible person prediction model.

[0009] Optionally, obtaining multiple sets of training sample data includes: obtaining multiple second operation records, wherein each second operation record includes: an operation object and a corresponding data lineage feature; classifying the multiple second operation records to obtain multiple clusters; for each cluster, determining the sensitive tag of each second operation record in the cluster based on a sensitive database, and when the sensitive tag of the second operation record indicates that it contains sensitive data, determining the sensitivity level of the sensitive data contained in the second operation record; determining the feature weight of each second operation record based on the sensitivity level, data lineage feature and sensitive tag of the sensitive data contained in each second operation record; vectorizing the feature weight of each second operation record using a word frequency-inverse file frequency algorithm, and determining the feature vector of each second operation record in combination with the data lineage feature and sensitive tag in the second operation record; determining the second real responsible person corresponding to the sensitive data based on a preset responsible person matching rule, wherein the responsible person matching rule is used to limit the association relationship between the feature vectors corresponding to multiple sensitive data and the responsible person; constructing multiple sets of training sample data from the feature vectors of each second operation record in multiple clusters and the corresponding second real responsible persons.

[0010] Optionally, before assigning the first target operation record to the corresponding first prediction responsible person for audit confirmation, the method also includes: locating the log source of the first target operation log based on the first operation log and the preset multi-category log structure diagram, and in combination with the important table set, wherein the log source includes at least one of the following: application log, Web log, 4A log integrating authentication, authorization, account, and audit, each log structure diagram is used to record the trajectory information of different data operations corresponding to each log source, and the important table set includes: multiple data tables involving sensitive data or important operations.

[0011] Optionally, the method also includes: determining the sensitive data field corresponding to the first target operation record based on the log source and preset query conditions; sending the log source of the first operation log and the sensitive data field corresponding to the first target operation record to the first prediction responsible person corresponding to the first target operation record for tracing processing.

[0012] According to another aspect of an embodiment of the present application, an operation log audit management system is also provided, including: an acquisition module for acquiring a first operation log to be processed, wherein the first operation log includes multiple first operation records; a determination module for determining the sensitive tags corresponding to each of the multiple first operation records based on a predefined sensitive database, wherein the sensitive database includes sensitive data of different sensitivity levels, and the sensitive tag is used to reflect whether the first operation record contains sensitive data; a prediction module for determining the sensitivity level of the sensitive data contained in the first target operation record when the sensitive tag of the first target operation record in the multiple first operation records indicates that it contains sensitive data, and using a pre-trained responsible person prediction model to analyze the first target operation record and the corresponding sensitive level to obtain the first predicted responsible person corresponding to the first target operation record; and an allocation module for allocating the first target operation record to the corresponding first predicted responsible person for audit confirmation.

[0013] According to another aspect of an embodiment of the present application, a computer program product is further provided, the computer program product comprising: a computer program, wherein when the computer program is executed by a processor, the above-mentioned operation log audit management method is implemented.

[0014] According to another aspect of an embodiment of the present application, an electronic device is further provided, which includes: a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to execute the above-mentioned operation log audit management method through the computer program.

[0015] In an embodiment of the present application, the system can perform a sensitivity analysis on each first operation record in the acquired first operation log through the sensitive database to determine whether it contains sensitive data, and assign corresponding sensitive tags according to the sensitive data of different sensitivity levels in the sensitive database. When it is found that the first target operation record contains sensitive data, the system will further determine the sensitivity level of the data, and use the responsible person prediction model to analyze the first target operation record and its sensitivity level, and predict the specific responsible person who is most likely to be responsible for the audit of this operation record, that is, the first predicted responsible person. Finally, the system automatically assigns the first target operation record to the first predicted responsible person, who will conduct further audit confirmation to ensure compliance with the operation of sensitive data. Therefore, the present application realizes the technical effect of automatic identification and classification of sensitive data in massive operation logs, and achieves the purpose of enhancing data security audit capabilities and optimizing sensitive data management processes. It also solves the technical problem of low efficiency and poor accuracy due to manual audit confirmation of sensitive information in massive operation records. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0017] Figure 1 This is a flowchart of an optional operation log audit management method according to an embodiment of the present application;

[0018] Figure 2 This is a schematic diagram of the principle of an optional operation log audit management method according to an embodiment of the present application;

[0019] Figure 3 This is an optional audit flow chart integrating 4A logs according to an embodiment of the present application;

[0020] Figure 4 This is an optional Web log audit flow chart according to an embodiment of the present application;

[0021] Figure 5 This is a flowchart of an optional operation log tracing according to an embodiment of the present application;

[0022] Figure 6 is a flow chart for confirming an optional important table set according to an embodiment of the present application;

[0023] Figure 7 This is a schematic diagram of the structure of an optional operation log audit management system according to an embodiment of the present application;

[0024] Figure 8 It is a schematic structural diagram of an optional electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0025] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of this application.

[0026] It should be noted that the terms "first", "second", etc. in the specification, claims, and drawings of the present application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product, or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products, or devices.

[0027] In order to better understand the embodiments of the present application, some nouns or terms that appear in the description of the embodiments of the present application are first translated and explained as follows:

[0028] Operation logs: These logs record operations initiated by maintenance personnel when they schedule system tasks. Operation logs record, but are not limited to, add, delete, and modify operations, but do not record general query operations.

[0029] The Term Frequency-Inverse Document Frequency (TF-IDF) algorithm is a commonly used weighting technique for information retrieval and mining, used to assess the importance of a term within a document set or a document within a corpus. TF represents the frequency of a term in a document. This number is typically normalized to simulate the bias towards longer documents. Therefore, the expression for TF can be written as:

[0030]

[0031] Where n i,j Indicates the term t i In file d j The number of times it appears in TF i,j It means the term t i In file d j The frequency of occurrence in . In addition, IDF indicates the prevalence of a keyword. If fewer documents contain term i, the greater the IDF, indicating that the term has good category differentiation capabilities. Therefore, the IDF of a term can be calculated by dividing the total number of documents by the number of documents containing the term, and then taking the logarithm of the quotient. Therefore, its expression can be written as:

[0032]

[0033] Where |D| represents the total number of all files, |j:ti ∈d j | indicates that the term t is included i The purpose of adding 1 is to prevent the inclusion of the term t i The number of documents in the search results is 0, which can cause calculation errors. Therefore, a high word frequency within a specific document and a low word frequency in the entire document collection can produce a high-weighted TF-IDF. Therefore, TF-IDF tends to filter out common words and retain important words, and its expression is the product of TF and IDF.

[0034] Cosine Similarity: This algorithm measures the angle between two non-zero vectors and is commonly used in fields such as text analysis, information retrieval, and recommendation systems. Cosine similarity focuses on the direction of two vectors rather than their magnitude, so it can effectively capture the similarity between vectors without being affected by their length. Therefore, the formula for calculating cosine similarity can be written as:

[0035]

[0036] Where A and B represent two non-zero vectors, A·B represents the dot product of vector A and vector B, and |A| and |B| represent the modulus of vector A and vector B, respectively.

[0037] Flume: is a distributed, reliable, and highly available log collection system, mainly used to efficiently collect, aggregate, and move large amounts of log data in the Hadoop ecosystem.

[0038] Hadoop: is an open source distributed computing platform mainly used to store and process large-scale data sets.

[0039] Kafka: An open-source distributed stream processing platform suitable for scenarios such as log collection and aggregation, messaging, stream processing, and event tracing.

[0040] Naive Bayes model: It is a classic probabilistic classification algorithm based on Bayes' theorem. It simplifies calculations by assuming that features are independent of each other. It has the advantages of high efficiency, easy implementation, and suitability for high-dimensional data.

[0041] Example 1

[0042] According to an embodiment of the present application, an operation log audit management method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0043] Figure 1 This is a flow chart of an operation log audit management method provided in accordance with an embodiment of the present application, such as Figure 1 As shown, the method includes the following steps:

[0044] Step S102: Obtain a first operation log to be processed from a target database.

[0045] In the technical solution provided in step S102 above, the target database may be a database that stores large-scale logs, such as Kafka, Hadoop, or a data mart. Furthermore, because the operation log is a record of operations performed by operation and maintenance personnel when initiating scheduled system tasks, the first operation log to be processed obtained from the target database may include multiple first operation records.

[0046] Step S104: determining sensitive tags corresponding to the plurality of first operation records based on a predefined sensitive database.

[0047] In the technical solution provided in step S104 above, multiple data can be pre-classified into different sensitivity levels based on factors such as the data's attributes or characteristics, resulting in a predefined sensitive database for targeted management and protection of objects. For example, private information such as a customer's name, ID number, and communication usage status can be defined as sensitive data. Therefore, in this embodiment of the present application, the sensitive database can be matched with multiple first operation records in the first operation log to obtain a sensitive tag corresponding to each first operation record. The sensitive tag can reflect whether the first operation record contains sensitive data.

[0048] Step S106: When the first target operation record in multiple first operation records is marked as containing sensitive data, determine the sensitivity level of the sensitive data contained in the first target operation record, and use the pre-trained responsible person prediction model to analyze the first target operation record and the corresponding sensitive level to obtain the first predicted responsible person corresponding to the first target operation record.

[0049] In the technical solution provided in step S106 above, when the first target operation record is flagged as containing sensitive data, the sensitivity level corresponding to the first target operation record can be further determined, namely, the sensitivity level of the sensitive data contained in the first target operation record. For such sensitive first target operation records, a pre-trained responsible person prediction model can be used to analyze the first target operation record and the corresponding sensitivity level to predict the first predicted responsible person who will subsequently audit and confirm the first target operation record.

[0050] Step S108: Allocate the first target operation record to the corresponding first forecast responsible person for audit confirmation.

[0051] In the technical solution provided in step S108 above, the first target operation record within the plurality of first operation records is added to the corresponding first forecast responsible person's audit confirmation task list, ensuring that each responsible person receives only the operation records relevant to their responsibilities and authority. Furthermore, the first forecast responsible person can conduct a detailed review through a visual interface to obtain the final audit confirmation result.

[0052] Based on the scheme defined by the above steps S102 to S108, it can be known that in the embodiment of the present application, the system can perform a sensitivity analysis on each first operation record in the obtained first operation log through the sensitive database to determine whether it contains sensitive data, and assign corresponding sensitive tags according to the sensitive data of different sensitivity levels in the sensitive database. When it is found that the first target operation record contains sensitive data, the system will further determine the sensitivity level of the data, and use the responsible person prediction model to analyze the first target operation record and its sensitive level, and predict the specific person who is most likely to be responsible for the audit of this operation record, that is, the first predicted responsible person. Finally, the system automatically assigns the first target operation record to the first predicted responsible person, who will conduct further audit confirmation to ensure compliance with the operation of sensitive data. Therefore, the embodiment of the present application achieves the technical effect of automatic identification and classification of sensitive data in massive operation logs, and achieves the purpose of enhancing data security audit capabilities and optimizing sensitive data management processes.

[0053] The following will be combined Figure 2 The schematic diagram is shown, and each step of the operation log audit management method is explained using a specific implementation process.

[0054] As an optional implementation, in the technical solution provided in the above step S102, the system can obtain the first operation log according to the following method, including: calling Flume to collect multiple first operation logs from multiple consumers, and storing the collected multiple first operation logs in sequence in the target database, and pulling the first operation log from the target database in a polling manner, wherein each first operation log includes multiple first operation records, and the first operation record includes the operation object and the corresponding data lineage characteristics, and the data lineage characteristics include but are not limited to: data type, activation status, table name, column name, database account, etc.

[0055] As an optional implementation, in the technical solution provided in step S104 above, the system may determine the sensitive tag of each first operation record according to the following method, including:

[0056] Step S1041: Determine a first hash value of the first operation log and obtain a second hash value of the second operation log of the target database that was last processed. Both the first hash value and the second hash value can be calculated using a hash algorithm such as MD5 or SHA-256, and the first hash value and the second hash value are stored and used as unique identifiers for the log files.

[0057] Step S1042 : When the first hash value and the second hash value are different, determining that at least one new first operation record is added to the first operation log compared to the second operation log.

[0058] Step S1043: Determine the sensitive information tag of each newly added first operation record in the first operation log based on a predefined sensitive information database.

[0059] In the above embodiment, the system compares the first hash value of the current first operation log with the second hash value of the previous operation log, triggered periodically or at a specific time. If the two hash values differ, this means that the contents of the log file have changed, that is, a new operation record has been added to the log file. In this case, the system can locate the specific newly added operation record based on the difference in hash values. The system then determines whether these newly added operation records contain sensitive data, avoiding repeated checks of all records and allowing for targeted subsequent audit confirmation, reducing ineffective work.

[0060] Optionally, the technical solution provided in step S1043 above can be implemented through the following steps:

[0061] For each newly added first operation record, the data lineage characteristics within the newly added first operation record are matched against the sensitive database. In other words, the data lineage characteristics within the newly added first operation record are used as query conditions to match against the sensitive database. The matching process involves comparing sensitive terms stored in the database with the terms appearing in the operation record, as well as querying structural information such as table names and column names.

[0062] When the matching result is a successful match, that is, the data lineage characteristics in the newly added first operation record successfully match any sensitive word in the sensitive database, at this time, the system can automatically mark the newly added first operation record as "contains sensitive data". This mark means that the newly added first operation record contains sensitive information that may affect data security and requires further review and audit confirmation.

[0063] When the matching result is a match failure, that is, the data lineage characteristics in the newly added first operation record cannot be successfully matched with any sensitive words in the sensitive database, at this time, the system can automatically mark the newly added first operation record as "does not contain sensitive data". This mark indicates that the newly added first operation record does not touch sensitive information, so there is no need for additional sensitive data audit process, and it can be directly archived or continue with normal log processing.

[0064] It should be noted that throughout the matching process, the system can design effective data structures and / or apply algorithms to accelerate feature matching while ensuring the reliability of matching results. For example, this can involve establishing indexes, optimizing query logic, and updating sensitive databases in real time to adapt to the ever-changing data environment. Alternatively, the cosine similarity algorithm can be used to measure the similarity between table or column names and sensitive terms to automatically match data features.

[0065] Through the above steps, the system can automatically identify and mark new first operation records that may contain sensitive information, laying the foundation for subsequent sensitive data confirmation and audit processes, while reducing unnecessary human resource consumption and improving the overall effectiveness of data security management.

[0066] As an optional implementation, the training process of the responsible party prediction model includes:

[0067] Step S1: Obtain multiple groups of training sample data.

[0068] Each set of training sample data includes the feature vector of the second operation record as a training sample and the second person actually responsible for auditing and confirming the second operation record as a sample label. The feature vector of the second operation record is a series of numerical values or symbols extracted from the operation record that reflect the characteristics of the operation, and the second person actually responsible is the person who confirmed the operation in the historical audit record.

[0069] Optionally, in the technical solution provided in the above step S1, it can be implemented by the following steps:

[0070] Step 1: Obtain multiple second operation records.

[0071] Specifically, create a topic log , using a one-to-many publish-subscribe mode (Publish-SubscribeMode), subscribing to the same log collection topic Topic to four consumers: sensitive word log consumers, integrated 4A log consumers, web access log consumers, and web export log consumers log; Use the pre-configured Kafka to collect log data, and transmit these log data to the Neo4J graph database through the data channel established by the memory channel, wherein multiple second operation records are stored in the database, and each second operation record includes: the operation object and the corresponding data lineage characteristics.

[0072] Step 2: Classify the multiple second operation records to obtain multiple clusters.

[0073] Specifically, the Cosine Similarity algorithm can be used to perform similarity matching between the operation object and data lineage features within each second operation record, obtaining clusters with a large overlap ratio and determining the classification label corresponding to each cluster. For example, if clustering is performed based on the table name dimension, the classification label corresponding to each cluster can be the table name.

[0074] Step 3: For each cluster, determine the sensitive tags of each second operation record in the cluster based on the sensitive database, and when the sensitive tag of the second operation record indicates that it contains sensitive data, determine the sensitivity level of the sensitive data contained in the second operation record; determine the feature weight of each second operation record based on the sensitivity level, data lineage characteristics and sensitive tags of the sensitive data contained in each second operation record; use the word frequency-inverse file algorithm to vectorize the feature weight of each second operation record, and determine the feature vector of each second operation record in combination with the data lineage characteristics and sensitive tags in the second operation record; determine the second real responsible person corresponding to the sensitive data based on the preset responsible person matching rule, wherein the responsible person matching rule is used to limit the association relationship between the feature vectors corresponding to multiple sensitive data and the responsible person.

[0075] Specifically, the expression of the cluster is expressed as in, represents the second operation record of the i-th cluster. Then the implementation process of the third step includes:

[0076] Clustering Analyze sensitive database Table st Based on the sensitivity level of the listed sensitive information, cluster Data st Add the weight of the classification label to get the sensitive label μ of the cluster st =F(Data st ,Label st ), where Label st is the classification label of the cluster. With the help of Spark tools, μ st and Table stConvert to Resilient Distributed Dataset (RDD) and get and And use its conversion operation to filter the data Therefore, if μ st The corresponding sensitive data is not in the sensitive database table st , then the record is marked as 0 (i.e., "sensitive data is not included"), otherwise it is marked as 1 (i.e., "sensitive data is included"), the formula is as follows:

[0077]

[0078] For clustering Data st Every second operation within Record the second operation Sensitive level, sensitive label μ st The features of the sensitive tags are weighted and vectorized using the TF-IDF algorithm to obtain the custom feature weight Data fw Therefore, the custom feature weight Data fw The expression can be written as:

[0079] vectorizer = Tf id idfVectorizer(Data fw )

[0080] Where vectorizer represents the TF-IDF weight of the feature weight of each second operation log. Then, based on the custom feature weight of each second operation record, its corresponding feature vector is determined:

[0081] X=vectorizer·fit_transform(Data feature )

[0082] Where fit_transform(Data feature ) represents the TF-IDF vector matrix of the feature vector of the second operation log.

[0083] Step 4: Construct multiple sets of training sample data based on the feature vectors of each second operation record in multiple clusters and the corresponding second real responsible persons. Therefore, each set of training sample data can be recorded as: (X, Data y ), where Data y Indicates the second real person responsible for auditing and confirming the second operation log.

[0084] Step S2, construct a deep learning model, where the types of deep learning models include but are not limited to: naive Bayes model, random forest model, support vector machine (SVM), gradient boosting decision tree (GBDT), etc. The embodiment of the present application does not impose specific restrictions on the selection of deep learning models, and specific decisions can be made based on actual application conditions.

[0085] Step S3: For each group of training samples, the second operation record in the training sample is input into the deep learning model to obtain the second predicted responsible person output by the deep learning model.

[0086] In step S4, a target loss function is constructed based on the second actual responsible person and the second predicted responsible person in each group of training samples, and the target loss function is optimized until a preset convergence condition is met, thereby obtaining a trained responsible person prediction model.

[0087] After training the responsible party prediction model using the above steps, the system can directly call on this model to analyze the first target operation record and the corresponding sensitivity level to determine the first predicted responsible party for the first target operation record. It should be noted that if the model cannot confirm the responsible party, the first target operation record can be labeled and submitted for manual centralized audit.

[0088] As an optional implementation, in the technical solution provided in the above step S108, when the system assigns the first target operation record to the corresponding first prediction responsible person for audit confirmation, the first prediction responsible person can conduct a detailed review through a visual interface. During the review process, the first prediction responsible person can confirm the rationality of the operation, whether it complies with the security policy, and whether it involves data leakage risks, etc., and feedback the final audit confirmation results to the system, including confirming that the operation is compliant, requires further investigation, or there is a violation, etc.

[0089] Furthermore, the system can update the audit status of the first target operation record based on the confirmation result fed back by the first prediction responsible person. For operation records that are confirmed to be compliant, the system will archive them and automatically count the number of compliant operations; for operation records that require further investigation or have violations, the system will trigger subsequent review processes, including dispatching auditors for a second review and notifying the security management department to intervene and make corrections. For example, Figure 3 、 4 They are the audit flow charts of monthly integrated 4A logs and Web logs.

[0090] Finally, the system maintains an audit confirmation log, recording each operation assigned to a responsible individual, the confirmation results, and the processing time. This facilitates statistical analysis and visualization in subsequent data security assessment application modules, ensuring continuous monitoring and improvement of data security. Through this process, sensitive operations are promptly identified, addressed, and recorded, improving data security transparency and management efficiency.

[0091] In addition, in order to efficiently process the first target operation records to be audited and confirmed, the embodiment of the present application can also trace the first target operation log according to the following method, including: based on the first target operation log and the preset multi-category log structure diagram, and combined with the important table set, locate the log source of the first target operation log.

[0092] Specifically, Figure 5 This is a flowchart of an optional operation log tracing according to an embodiment of the present application, such as Figure 5 As shown. First, one or more important data tables are selected from the important table set as the focus of the traceability analysis. For the selected important tables, the sensitive words, 4A operation logs, Web access logs, and Web export logs associated with them are searched and traceability analysis is performed. After completing the traceability of sensitive words, 4A operation logs, Web access logs, and Web export logs, the system will visually display the confirmed sensitive words and related information (including the context of sensitive words, the identity of the operator, the time of operation, etc.), 4A operation logs and related information (including the specific content of the operation, the context of the operation, the operator information and the sensitive words associated with it, etc.), Web access logs and related information (including the identity of the visitor, the time of visit, the page or report visited, the sensitivity of the exported data, etc.), and Web export logs and related information (including the detailed content of the exported data, the export time, the identity of the exporter, etc.) to the responsible person.

[0093] Furthermore, the system can also determine the sensitive data field corresponding to the first target operation record based on the log source and the preset query conditions. Among them, the preset query conditions operation time, operation type, operator, affected data table, etc.; the sensitive data fields corresponding to the log source of the first operation log and the first target operation record It is sent to the first prediction responsible person of the first target operation record for traceability processing.

[0094] The log structure diagram is constructed based on different log sources and operation types, where log sources include but are not limited to: Application log Grid app 、Web Log Grid web , 4A Log Grid integrating authentication, authorization, account, and audit fourEach log structure graph is stored in the form of a graph database (such as Neo4j). The nodes in the graph represent specific elements or entities in the operation log, such as database accounts, operation time, operation commands, etc., while the edges represent the associations between these elements, such as the correspondence between operators and operation time, and the association between operation commands and operation results.

[0095] In addition, the important table set It includes all the data tables that are confirmed as important levels according to data classification and the confirmation process of each data table is as follows: Figure 6 As shown, it is not difficult to see that the confirmation process includes: extracting sensitive words considered to be key from the data classification and grading identification results, and obtaining audit table information related to sensitive data operations from the integrated 4A platform, including database operation logs, which record detailed records of operations such as adding, deleting, modifying, and querying sensitive data, and extracting configuration reports related to data operations from the application system; then, screening out specific application systems from multiple applications, and further confirming the list reports that need to be reviewed in detail in the selected applications. From the confirmed list reports, identify reports that have a significant impact on enterprise operations and data security; then, based on the important list reports, find and list all associated data tables. These tables may be the direct storage locations of sensitive data or key nodes through which sensitive data flows; finally, define and identify the associated tables obtained in the previous step, clarifying their role in the data flow and whether they contain sensitive information. At the same time, configure the data tables marked as "important" to obtain the data tables confirmed as important tables, forming a list or database. Therefore, the important table set can be used as the basis for log location and analysis, and can help the system quickly identify log records related to important data tables.

[0096] Specifically, the above tracing process can be understood as follows: when the first operation log is received, the system will use Cypher query language or other graphic database query methods based on the important table set and the preset log structure diagram, and perform detailed query and positioning in the corresponding log structure diagram according to the key information in the first operation log (such as database account, operation time, table name, etc.), so as to quickly identify the specific location of the first operation log in the log chain and other related log records.

[0097] After completing the positioning, the system can also use the powerful graph traversal and path finding capabilities of the graph database to further analyze the log records associated with the first operation log, and trace the sensitive data fields closely related to the first target operation record to determine which fields were accessed or modified during the operation, thereby determining whether they are sensitive. Next, the system feeds the log source and sensitive data field information of the first operation log to the first prediction responsible person. The specific feeding method can be that the system generates a tracing processing request, which contains the log source information of the first operation log and the details of the sensitive data field, and sends the request to the work interface of the first prediction responsible person or notifies the responsible person through email, instant messaging, etc., so that the responsible person can review the operation records and track the sensitive data in a timely manner.

[0098] Finally, upon receiving the request, the first person responsible for the prediction will conduct a detailed review of the first target's operation records based on their responsibilities and authority, and trace the processing of sensitive data fields. After completing the review, they will return feedback (such as confirmation, correction, or reporting of anomalies) to the system, completing a closed-loop traceability process.

[0099] Through the above steps, a highly efficient and accurate automatic identification and confirmation solution for sensitive data has been created. By deploying Flume and Kafka, this solution realizes the unified collection and efficient processing of multi-source log data such as sensitive word scanning logs, integrated 4A logs, and Web access logs, avoiding the data island phenomenon, enhancing the consistency and global visibility of log data, and providing a solid foundation for subsequent data analysis and auditing. At the same time, the embodiment of the present application predicts the responsible person corresponding to each operation record through the model, greatly reducing the workload of manual task assignment and reducing data risks caused by human errors. It can also help enterprises to promptly discover and deal with potential data security threats through real-time analysis and traceability, and ensure the security and stability of the enterprise's core data.

[0100] Example 2

[0101] According to an embodiment of the present application, an operation log audit management system for implementing the operation log audit management method in Example 1 is also provided. Figure 7 As shown, the operation log audit management system includes at least: an acquisition module 72, a determination module 74, a prediction module 76 and an allocation module 78, wherein:

[0102] An acquisition module 72 is configured to acquire a first operation log to be processed, wherein the first operation log includes a plurality of first operation records;

[0103] a determination module 74 configured to determine a sensitive tag corresponding to each of the plurality of first operation records based on a predefined sensitive database, wherein the sensitive database includes sensitive data of different sensitivity levels, and the sensitive tag is configured to indicate whether the first operation record contains sensitive data;

[0104] Prediction module 76 is configured to, when a first target operation record within the plurality of first operation records is flagged as containing sensitive data, determine the sensitivity level of the sensitive data contained in the first target operation record, and analyze the first target operation record and the corresponding sensitivity level using a pre-trained responsible person prediction model to obtain a first predicted responsible person corresponding to the first target operation record;

[0105] The allocation module 78 is used to allocate the first target operation record to the corresponding first forecast responsible person for audit confirmation.

[0106] It should be noted that each module in the operation log audit management system in the embodiment of the present application corresponds one-to-one to each implementation step of the operation log audit management method in Example 1. Since a detailed description has been given in Example 1, some details not reflected in this embodiment can be referred to Example 1 and will not be elaborated here.

[0107] Example 3

[0108] According to an embodiment of the present application, a computer program product is also provided, which includes a computer program, wherein when the computer program is executed by a processor, the operation log audit management method in Example 1 is implemented.

[0109] According to an embodiment of the present application, a non-volatile storage medium is also provided, which includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the operation log audit management method in Example 1 by running the computer program.

[0110] According to an embodiment of the present application, a processor is further provided, which is used to run a computer program, wherein the operation log audit management method in Example 1 is executed when the computer program is running.

[0111] According to an embodiment of the present application, an electronic device is also provided, which includes: a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to execute the operation log audit management method in Example 1 through the computer program.

[0112] Specifically, the computer program executes the following steps when it is running: obtaining a first operation log to be processed from a target database, wherein the first operation log includes multiple first operation records; determining sensitive tags corresponding to each of the multiple first operation records based on a predefined sensitive database, wherein the sensitive database includes sensitive data of different sensitivity levels, and the sensitive tag is used to reflect whether the first operation record contains sensitive data; when the sensitive tag of the first target operation record among the multiple first operation records indicates that it contains sensitive data, determining the sensitivity level of the sensitive data contained in the first target operation record, and using a pre-trained responsible person prediction model to analyze the first target operation record and the corresponding sensitive level to obtain the first predicted responsible person corresponding to the first target operation record; and allocating the first target operation record to the corresponding first predicted responsible person for audit confirmation.

[0113] As an optional implementation, the electronic device may be in the form of a mobile terminal, a computer terminal or a similar computing device. Figure 8 The hardware structure block diagram of an electronic device for implementing the operation log audit management method is shown. Figure 8 As shown, the electronic device 80 may include one or more (802a, 802b, ..., 802n are used to illustrate) processors 802 (the processor 802 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 804 for storing data, and a transmission device 806 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It will be understood by those skilled in the art that Figure 8 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 8 More or fewer components than shown, or with Figure 8 Different configurations shown.

[0114] It should be noted that the one or more processors 802 and / or other data processing circuits described above may generally be referred to herein as "data processing circuitry". The data processing circuitry may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuitry may be a single independent processing module, or may be incorporated in whole or in part into any of the other components of the electronic device 80. As described in the embodiments of the present application, the data processing circuitry serves as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0115] The memory 804 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the operation log audit management method in the embodiment of the present application. The processor 802 executes various functional applications and data processing by running the software programs and modules stored in the memory 804, that is, implementing the vulnerability detection method of the above-mentioned application. The memory 804 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 804 may further include a memory remotely located relative to the processor 802, and these remote memories may be connected to the electronic device 80 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0116] The transmission device 806 is used to receive or send data via a network. Specific examples of the aforementioned network may include a wireless network provided by the communications provider of the electronic device 80. In one embodiment, the transmission device 806 includes a network interface controller (NIC), which can be connected to other network devices via a base station to enable communication with the Internet. In one embodiment, the transmission device 806 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0117] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the electronic device 80 .

[0118] The serial numbers of the above embodiments are for description only and do not represent the advantages or disadvantages of the embodiments.

[0119] In the above embodiments of the present application, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0120] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only exemplary. For example, the division of units can be a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0121] Units described as separate components may or may not be physically separate, and components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple units. Some or all of the units may be selected to achieve the purpose of the present embodiment according to actual needs.

[0122] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0123] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, server or network device, etc.) to execute all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program code.

[0124] The above is only a preferred embodiment of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. An operation log audit management method, characterized in that: include: Obtaining a first operation log to be processed from a target database, wherein the first operation log includes a plurality of first operation records; Determining, based on a predefined sensitive database, sensitive tags corresponding to each of the plurality of first operation records, wherein the sensitive database includes sensitive data of different sensitivity levels, and the sensitive tags are used to reflect whether the first operation record contains the sensitive data; If the first target operation record in the plurality of first operation records is marked as containing sensitive data, determining the sensitivity level of the sensitive data contained in the first target operation record, and analyzing the first target operation record and the corresponding sensitivity level using a pre-trained responsible person prediction model to obtain a first predicted responsible person corresponding to the first target operation record; The first target operation record is assigned to the corresponding first forecast responsible person for audit confirmation.

2. The method according to claim 1, characterized in that Determining the sensitive tags corresponding to each of the plurality of first operation records based on a predefined sensitive database includes: Determine a first hash value of the first operation log, and obtain a second hash value of a second operation log last processed at the target database; When the first hash value is different from the second hash value, determining that at least one first operation record is newly added in the first operation log compared to the second operation log; Determine the sensitive tag of each newly added first operation record in the first operation log based on the sensitive database.

3. The method according to claim 2, characterized in that The first operation record includes an operation object and a corresponding data lineage feature, and the data lineage feature includes at least one of the following: data type, activation status, table name, column name, and database account. The sensitive tag of each newly added first operation record in the first operation log is determined based on the sensitive database, including: For each newly added first operation record, matching the data lineage feature in the newly added first operation record with the sensitive database; If the matching result is successful, determining that the newly added first operation record contains sensitive data as a sensitive data; When the obtained matching result is a matching failure, the sensitive mark of the newly added first operation record is determined to be not containing sensitive data.

4. The method according to claim 1, wherein The training process of the responsible person prediction model includes: Acquire multiple sets of training sample data, wherein each set of the training sample data includes: a feature vector of the second operation record, and a second person actually responsible for auditing and confirming the second operation record; Build deep learning models; For each group of training samples, inputting the second operation record in the training sample into the deep learning model to obtain a second predicted responsible person output by the deep learning model; A target loss function is constructed based on the second actual responsible person and the second predicted responsible person in each group of training samples, and the target loss function is optimized until a preset convergence condition is met, thereby obtaining the responsible person prediction model that has completed training.

5. The method according to claim 4, characterized in that Obtain multiple sets of training sample data, including: Acquire multiple second operation records, wherein each second operation record includes: an operation object and corresponding data lineage characteristics; Classifying the plurality of second operation records to obtain a plurality of clusters; For each of the clusters, determine the sensitive tags of each second operation record in the cluster based on the sensitive database, and when the sensitive tag of the second operation record indicates that it contains sensitive data, determine the sensitivity level of the sensitive data contained in the second operation record; determine the feature weight of each second operation record based on the sensitivity level, data lineage characteristics and sensitive tags of the sensitive data contained in each second operation record; use the word frequency-inverse file frequency algorithm to vectorize the feature weight of each second operation record, and determine the feature vector of each second operation record in combination with the data lineage characteristics and sensitive tags in the second operation record; determine the second real person responsible for the sensitive data based on the preset person responsible matching rule, wherein the person responsible matching rule is used to define the association relationship between the feature vectors corresponding to multiple sensitive data and the person responsible; The multiple groups of training sample data are constructed based on the feature vectors of the second operation records in the multiple clusters and the corresponding second real responsible persons.

6. The method according to claim 1, characterized in that Before allocating the first target operation record to the corresponding first forecast responsible person for audit confirmation, the method further includes: Based on the first operation log and the preset multi-category log structure diagram, and in combination with the important table set, the log source of the first target operation log is located, wherein the log source includes at least one of the following: application log, web page log, 4A log integrating authentication, authorization, account, and audit. Each of the log structure diagrams is used to record the trajectory information of different data operations corresponding to each of the log sources. The important table set includes: multiple data tables involving sensitive data or important operations.

7. The method according to claim 6, characterized in that The method further comprises: Determining the sensitive data field corresponding to the first target operation record based on the log source and preset query conditions; The log source of the first operation log and the sensitive data fields corresponding to the first target operation record are sent to the first prediction responsible person corresponding to the first target operation record for tracing processing.

8. An operation log audit management system, characterized in that: include: an acquisition module, configured to acquire a first operation log to be processed, wherein the first operation log includes a plurality of first operation records; a determination module, configured to determine, based on a predefined sensitive database, a sensitive tag corresponding to each of the plurality of first operation records, wherein the sensitive database includes sensitive data of different sensitivity levels, and the sensitive tag is used to reflect whether the first operation record contains the sensitive data; a prediction module configured to, when a first target operation record within the plurality of first operation records is marked as containing sensitive data, determine a sensitivity level of the sensitive data contained in the first target operation record, and analyze the first target operation record and the corresponding sensitivity level using a pre-trained responsible person prediction model to obtain a first predicted responsible person corresponding to the first target operation record; An allocation module is used to allocate the first target operation record to the corresponding first forecast responsible person for audit confirmation.

9. A computer program product, characterized in that include: A computer program, wherein when the computer program is executed by a processor, it implements the operation log audit management method according to any one of claims 1 to 7.

10. An electronic device, characterized in that: include: A memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the operation log audit management method according to any one of claims 1 to 7 through the computer program.

Images