AI security monitoring method and system based on database access analysis

Abstract

The invention discloses an AI security monitoring method and system based on database access analysis. The method comprises the following steps: acquiring an access request of a target user to a target database; based on a neural network model, predicting a key concerned field in the access request; according to a plurality of historical access records related to the target database, analyzing a field risk corresponding to the key concerned field; and determining an access strategy when the target user accesses the target database according to the field risk. It can be seen that accurate database access control based on the key concern field and risk assessment can be achieved, the safety and access efficiency of the target database are improved, and the access vulnerability risk caused by the risk field is reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, and in particular to an AI security monitoring method and system based on database access analysis. BACKGROUND

[0002] With the rapid growth of data security and efficient access demand, enterprises and institutions pay more and more attention to protecting sensitive information through precise database access control, and how to effectively identify high-risk fields and optimize access strategies becomes a key technical problem. The existing technology usually collects user access requests to the database, assigns access permissions by using fixed permission rules or simple log analysis methods, and manages database access based on standard strategies to ensure data security. The existing solution lacks dynamic prediction of key focus fields and risk analysis of historical access records, making it difficult to accurately assess field risks and develop targeted access strategies, resulting in insufficient database security, easy access vulnerabilities due to risk field exposure, and limiting access efficiency and data protection effectiveness. Therefore, the existing technology has defects and needs to be solved. SUMMARY

[0003] The technical problem to be solved by the present application is to provide an AI security monitoring method and system based on database access analysis, which can realize precise database access control based on key focus fields and risk assessment, improve the security and access efficiency of the target database, and reduce the risk of access vulnerabilities caused by risk fields.

[0004] To solve the above technical problems, the first aspect of the present application discloses an AI security monitoring method based on database access analysis, which comprises: obtaining an access request of a target user to a target database; predicting a key focus field in the access request based on a neural network model; analyzing the field risk corresponding to the key focus field according to a plurality of historical access records related to the target database; determining an access strategy of the target user when accessing the target database according to the field risk.

[0005] As an optional implementation, in the first aspect of the present application, the prediction of the key focus field in the access request based on the neural network model comprises: determining at least one universal field based on a plurality of historical access records of the target user; determining other fields in the access request except the universal field as predicted fields; inputting the predicted fields into a trained risk field identification neural network to obtain the key focus field in the access request.

[0006] As an optional implementation, in the first aspect of the present invention, determining at least one common field based on multiple historical access records of the target user includes: Obtaining multiple historical access records of the target user; Filtering the historical access records of successful access to the database to obtain multiple successful access records; An intersection of field types of all historical access requests in the successful access records is calculated to obtain at least one common field.

[0007] As an optional embodiment, in the first aspect of the present invention, the risk field recognition neural network is a CNN network architecture, which is obtained by training a training data set including multiple training field data and corresponding risk attention level annotations.

[0008] As an optional implementation, in the first aspect of the present invention, analyzing the field risk corresponding to the key focus field based on multiple historical access records related to the target database includes: Determining a plurality of similar databases similar to the target database from a preset database set; Traversing all the historical access records of the similar databases for records containing dangerous access situations to obtain multiple dangerous access records; For each of the key focus fields, calculating the similarity between each request field of each dangerous access request in each of the dangerous access records and the key focus field; Filtering the request fields whose similarity is greater than a preset first similarity threshold to obtain dangerous fields; An average value of the similarities corresponding to all the risk fields is determined as the field risk corresponding to the key focus field.

[0009] As an optional embodiment, in the first aspect of the present invention, the parameter similarity between the database parameters corresponding to the similar database and the database parameters of the target database is greater than a preset second similarity threshold; the database parameters include at least one of the database storage location, database size, data type in the database, database architecture and database language type.

[0010] As an optional implementation, in the first aspect of the present invention, the access policy includes access parameters and access permissions; the access parameters include access encryption level, access container, and access transit parameters.

[0011] As an optional implementation, in the first aspect of the present application, the determining of the access strategy of the target user when accessing the target database according to the field risk comprises: calculating an average value of the field risks of all the fields of interest to obtain an access risk value; determining whether the access risk value is greater than a preset first risk value threshold to obtain a first determination result; if the first determination result is yes, determining that the access permission is not allowed to access; if the first determination result is no, determining that the access permission is allowed to access, and determining whether the access risk value is less than a preset second risk value threshold to obtain a second determination result; the second risk value threshold is less than the first risk value threshold; if the second determination result is yes, determining that the access parameter is an access parameter corresponding to directly accessing the target database; if the second determination result is no, determining the access parameter corresponding to the security level in a preset risk value and parameter corresponding relationship according to the access risk value.

[0012] The second aspect of the embodiment of the present application discloses an AI security monitoring system based on database access analysis, and the system comprises: an acquisition module configured to acquire an access request of a target user to a target database; a prediction module configured to predict fields of interest in the access request based on a neural network model; an analysis module configured to analyze field risks corresponding to the fields of interest according to a plurality of historical access records related to the target database; a determination module configured to determine an access strategy of the target user when accessing the target database according to the field risks.

[0013] As an optional implementation, in the second aspect of the present application, the specific manner in which the prediction module predicts the fields of interest in the access request based on the neural network model comprises: determining at least one universal field based on a plurality of historical access records of the target user; determining other fields in the access request except the universal field as to-be-predicted fields; inputting the to-be-predicted fields into a trained risk field identification neural network to obtain the fields of interest in the access request.

[0014] As an optional implementation, in the second aspect of the present application, the specific manner in which the prediction module determines at least one universal field based on a plurality of historical access records of the target user comprises: obtain a plurality of historical access records of the target user; screen the historical access records that successfully access the database to obtain a plurality of successful access records; calculate the intersection of the field types of the historical access requests in all the successful access records to obtain at least one universal field.

[0015] As an optional implementation, in the second aspect of the present application, the risk field identification neural network is a CNN network architecture, which is obtained by training a training data set including a plurality of training field data and corresponding risk attention degree labels.

[0016] As an optional implementation, in the second aspect of the present application, the analysis module analyzes the specific manner of the field risk corresponding to the key attention field according to a plurality of historical access records related to the target database, which includes: determine a plurality of similar databases similar to the target database in a preset database set; traverse the records of dangerous access situations in the historical access records of all the similar databases to obtain a plurality of dangerous access records; for each key attention field, calculate the similarity between each request field of each dangerous access request in each dangerous access record and the key attention field; screen the request fields with a similarity greater than a preset first similarity threshold to obtain dangerous fields; determine the average value of the similarity corresponding to all the dangerous fields as the field risk corresponding to the key attention field.

[0017] As an optional implementation, in the second aspect of the present application, the parameter similarity between the database parameters corresponding to the similar database and the database parameters of the target database is greater than a preset second similarity threshold; the database parameters include at least one of database storage location, database size, database data type, database architecture and database language type.

[0018] As an optional implementation, in the second aspect of the present application, the access strategy includes access parameters and access permissions; the access parameters include access encryption degree, access container and access transfer parameters.

[0019] As an optional implementation, in the second aspect of the present application, the determination module determines the specific manner of the access strategy when the target user accesses the target database according to the field risk, which includes: calculate the average value of the field risks of all the key attention fields to obtain an access risk value; determine whether the access risk value is greater than a preset first risk value threshold to obtain a first determination result; if the first determination result is yes, determine that the access permission is not permitted to access; if the first determination result is no, determine that the access permission is permitted to access, and determine whether the access risk value is less than a preset second risk value threshold to obtain a second determination result; the second risk value threshold is less than the first risk value threshold; if the second determination result is yes, determine that the access parameter is an access parameter corresponding to directly accessing the target database; if the second determination result is no, determine the access parameter corresponding to the security degree in a preset risk value and parameter corresponding relationship according to the access risk value.

[0020] The third aspect of the present application discloses another AI security monitoring system based on database access analysis, which comprises: a memory storing executable program codes; a processor coupled with the memory; The processor calls the executable program codes stored in the memory to execute part or all of the steps of the AI security monitoring method based on database access analysis disclosed in the first aspect of the present application.

[0021] The fourth aspect of the present application discloses a computer storage medium storing computer instructions, which are used to execute part or all of the steps of the AI security monitoring method based on database access analysis disclosed in the first aspect of the present application when called.

[0022] Compared with the prior art, the embodiments of the present application have the following beneficial effects: The present application can realize precise database access control based on the key attention field and risk assessment by obtaining the access request of the target user to the target database and predicting the key attention field based on the neural network model, analyzing the field risk combined with the historical access record and determining the access strategy, thereby improving the security and access efficiency of the target database and reducing the risk of access vulnerability caused by the risk field. BRIEF DESCRIPTION OF DRAWINGS

[0023] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0024] Figure 1is a flow diagram of an AI security monitoring method based on database access analysis disclosed by an embodiment of the present application.

[0025] Figure 2 is a structural diagram of an AI security monitoring system based on database access analysis disclosed by an embodiment of the present application.

[0026] Figure 3 is a structural diagram of another AI security monitoring system based on database access analysis disclosed by an embodiment of the present application. DETAILED DESCRIPTION

[0027] In order for those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0028] The terms "first", "second", and the like in the specification and claims of the present application and the above-described drawings are used to distinguish different objects, not to describe a specific order. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, device, product, or equipment including a series of steps or units is not limited to the listed steps or units, but can optionally include steps or units not listed, or can optionally include other steps or units inherent to the process, method, product, or equipment.

[0029] In this document, reference to "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the application. The appearance of the phrase in various places in the specification does not necessarily all refer to the same embodiment, nor is it necessarily mutually exclusive of other embodiments. It is explicitly and implicitly understood that the embodiments described herein can be combined with other embodiments.

[0030] The present application discloses an AI security monitoring method and system based on database access analysis. By obtaining the access request of the target user to the target database and predicting the key attention field based on the neural network model, the field risk is analyzed and the access strategy is determined, so as to realize precise database access control based on the key attention field and risk assessment, improve the security and access efficiency of the target database, and reduce the risk of access vulnerability caused by the risk field. The following will be described in detail.

[0031] Embodiment one Please refer to Figure 1 , Figure 1 is a flowchart of an AI security monitoring method based on database access analysis according to an embodiment of the present application. Among them, Figure 1 The AI security monitoring method based on database access analysis described can be applied in a data processing system / data processing device / data processing server (wherein the server includes a local processing server or a cloud processing server). As Figure 1 shown, the AI security monitoring method based on database access analysis can include the following operations: 101, obtaining an access request of a target user to a target database.

[0032] Optionally, the access request can include a query statement, a field list, an operation type, or user identity information, which is not limited by the present application.

[0033] Optionally, the target database can be a relational database, a non-relational database, or a distributed database, which is not limited by the present application.

[0034] Optionally, the obtaining process can be implemented based on API calling, database interface, user input, or log capture, which is not limited by the present application.

[0035] 102, based on a neural network model, predicting a key focus field in the access request. Optionally, the neural network model can be a convolutional neural network, a recurrent neural network, or a Transformer model, which is not limited by the present application.

[0036] Optionally, the key focus field can be a key query field, a sensitive data field, or a high-frequency access field, which is not limited by the present application.

[0037] 103, according to a plurality of historical access records related to the target database, analyzing the field risk corresponding to the key focus field. Optionally, the historical access record can include access time, access field, access result, or user behavior data, which is not limited by the present application.

[0038] Optionally, the field risk can be a risk score, a sensitivity level, or an abnormal probability, which is not limited by the present application.

[0039] Optionally, the analysis process can be implemented based on statistical analysis, pattern recognition, or machine learning algorithm, which is not limited by the present application.

[0040] 104, according to the field risk, determining an access strategy when the target user accesses the target database.

[0041] Optionally, the access policy may include access permission, access parameters, access restrictions or logging rules, which are not limited in the present invention.

[0042] It can be seen that the above-mentioned embodiment of the invention obtains the target user's access request to the target database and predicts the key focus fields based on the neural network model, analyzes the field risks in combination with historical access records and determines the access strategy, thereby realizing precise database access control based on key focus fields and risk assessment, improving the security and access efficiency of the target database, and reducing the risk of access vulnerabilities caused by risky fields.

[0043] As an optional embodiment, in the above step, predicting the key fields in the access request based on the neural network model includes: Determining at least one common field based on multiple historical access records of the target user; Determine other fields in the access request except the common fields as fields to be predicted; The fields to be predicted are input into the trained risk field recognition neural network to obtain the key focus fields in the access request.

[0044] Optionally, the universal field may be a high-frequency access field, a non-sensitive field, or a public field, which is not limited in the present invention.

[0045] Optionally, the historical access record may be a single user record, a group user record, or a time period record, which is not limited in the present invention.

[0046] It can be seen that through the above optional embodiments, by determining the common fields based on the historical access records of the target user and inputting the remaining fields into the risk field identification neural network to predict the key focus fields, the accuracy and pertinence of the key focus field identification are improved through historical record screening and neural network prediction on the basis of precise access strategy determination, providing a reliable basis for field risk analysis and reducing access security risks caused by improper field screening.

[0047] As an optional embodiment, in the above step, determining at least one common field based on multiple historical access records of the target user includes: Obtain multiple historical access records of the target user; Filter out historical access records of successful access to the database to obtain multiple successful access records; The intersection of the field types of the historical access requests in all successful access records is calculated to obtain at least one common field.

[0048] Optionally, the historical access record may include an access timestamp, a request field, an access result, or user identity information, which is not limited in the present invention.

[0049] Optionally, the acquisition process can be based on database logs, user behavior tracking or data interfaces, without limitation of the application.

[0050] Optionally, the success access record can be an error-free record, an exception-free record or a normal completion record, without limitation of the application.

[0051] Optionally, the field type can be a data type, a field name or a field purpose, without limitation of the application.

[0052] Optionally, the intersection calculation process can be based on set operations, statistical analysis or pattern matching, without limitation of the application.

[0053] As can be seen, through the above optional embodiments, the universal field is determined by screening the target user success access records and calculating the intersection of the historical access request field types, thereby improving the accuracy and representativeness of the universal field extraction through success record analysis on the basis of precise focus on field prediction, providing high-quality historical data support for the determination of the to-be-predicted field, and reducing the risk of field classification errors caused by incomplete historical records.

[0054] As an optional embodiment, in the above steps, the risk field identification neural network is a CNN network architecture, which is trained by a training data set including a plurality of training field data and corresponding risk attention degree labels.

[0055] As can be seen, through the above optional embodiments, the details of the risk field identification neural network are limited to accurately identify the focus attention field in the subsequent process, thereby assisting in implementing precise database access control based on the focus attention field and risk assessment, improving the security and access efficiency of the target database, and reducing the risk of access vulnerabilities caused by risk fields.

[0056] As an optional embodiment, in the above steps, the field risk corresponding to the focus attention field is analyzed according to a plurality of historical access records related to the target database, including: determining a plurality of similar databases similar to the target database in a preset database set; traversing records with dangerous access situations in the historical access records of all similar databases to obtain a plurality of dangerous access records; for each focus attention field, calculating the similarity between each request field of each dangerous access request in each dangerous access record and the focus attention field; filtering out request fields with a similarity greater than a preset first similarity threshold to obtain dangerous fields; determining the average value of the similarities of all dangerous fields as the field risk corresponding to the focus attention field.

[0057] Optionally, the similar database can be determined based on database structure, data type or access mode, without limitation of the present application.

[0058] Optionally, the determination process of the similar database can be implemented based on similarity calculation, cluster analysis or rule matching, without limitation of the present application.

[0059] Optionally, the dangerous access condition can be unauthorized access, abnormal query or data leakage, without limitation of the present application.

[0060] Optionally, the traversal process can be implemented based on log scanning, anomaly detection or data filtering, without limitation of the present application.

[0061] Optionally, the similarity can be cosine similarity, Jaccard coefficient or semantic similarity, without limitation of the present application.

[0062] Optionally, the first similarity threshold can be a fixed threshold, a dynamic threshold or a threshold adjusted based on field sensitivity, without limitation of the present application.

[0063] As can be seen, through the above optional embodiments, the field risk is determined by screening the similar database to the target database and analyzing the similarity between the request field and the focus field in the dangerous access record, thereby improving the comprehensiveness and accuracy of the field risk assessment based on the accurate access strategy determination, providing reliable risk quantification for the access control decision, and reducing the risk of database leakage caused by risk misjudgment.

[0064] As an optional embodiment, in the above steps, the parameter similarity between the database parameters corresponding to the similar database and the database parameters of the target database is greater than a preset second similarity threshold; the database parameters include at least one of database storage location, database size, database data type, database architecture and database language type.

[0065] Optionally, the parameter similarity can be cosine similarity, Jaccard coefficient or semantic similarity, without limitation of the present application.

[0066] As can be seen, through the above optional embodiments, the screening details of the similar database are limited to facilitate the subsequent accurate analysis of the risk degree of the risk field, to assist in realizing the accurate database access control based on the focus field and the risk assessment, to improve the security and access efficiency of the target database, and to reduce the access vulnerability risk caused by the risk field.

[0067] As an optional embodiment, in the above steps, the access strategy includes access parameters and access permissions; the access parameters include access encryption level, access container and access transfer parameters.

[0068] Optionally, the access container can be a parameter of an access container construction mode or a constructed container.

[0069] Optionally, the access transit parameter can be a parameter of a route, a node, and a number of nodes for forwarding by an intermediate node when accessing the target database.

[0070] As can be seen, through the above optional embodiments, the parameter details of the access strategy are limited to accurately guide the access mode of the user subsequently, to assist in realizing precise database access control based on the focus field and risk assessment, to improve the security and access efficiency of the target database, and to reduce the risk of access vulnerability caused by the risk field.

[0071] As an optional embodiment, in the above steps, determining the access strategy of the target user when accessing the target database according to the field risk includes: calculating the average value of the field risk of all focus fields to obtain an access risk value; determining whether the access risk value is greater than a preset first risk value threshold to obtain a first determination result; if the first determination result is yes, determining that the access permission is not allowed to access; if the first determination result is no, determining that the access permission is allowed to access, and determining whether the access risk value is less than a preset second risk value threshold to obtain a second determination result; optionally, the second risk value threshold is less than the first risk value threshold; if the second determination result is yes, determining that the access parameter is an access parameter corresponding to directly accessing the target database; if the second determination result is no, determining the access parameter corresponding to the security degree in a preset risk value and parameter corresponding relationship according to the access risk value.

[0072] Optionally, the first risk value threshold and the second risk value threshold can be fixed thresholds, dynamic thresholds, or thresholds adjusted based on database sensitivity, which are not limited by the present application.

[0073] Optionally, the not allowed to access can be completely refused, temporarily limited, or required to be additionally authenticated, which are not limited by the present application.

[0074] Optionally, the corresponding relationship can be a mapping table, a rule library, or a data-driven model, which are not limited by the present application.

[0075] It can be seen that, through the above optional embodiments, the risk average value of the key attention field is calculated as the access risk value, and the access permission and parameters are determined based on the threshold judgment, so as to optimize and improve the flexibility and security of the access decision based on the accurate access strategy determination, provide adaptive control for the target user database access, and reduce the risk of improper access caused by improper risk value evaluation.

[0076] Embodiment Two Please refer to Figure 2 , Figure 2 is a structural schematic diagram of an AI security monitoring system based on database access analysis disclosed by an embodiment of the present application. Among them, Figure 2 The AI security monitoring system based on database access analysis described can be applied in a data processing system / data processing device / data processing server (wherein the server includes a local processing server or a cloud processing server). As Figure 2 indicated, the AI security monitoring system based on database access analysis can include: The acquisition module 201 is configured to acquire an access request of a target user to a target database.

[0077] The prediction module 202 is configured to predict a key attention field in the access request based on a neural network model. The analysis module 203 is configured to analyze a field risk corresponding to the key attention field according to a plurality of historical access records related to the target database. The determination module 204 is configured to determine an access strategy of the target user when accessing the target database according to the field risk.

[0078] It can be seen that the above embodiments of the application can realize accurate database access control based on the key attention field and risk assessment by acquiring the access request of the target user to the target database and predicting the key attention field based on the neural network model, analyzing the field risk in combination with the historical access records and determining the access strategy, thereby improving the security and access efficiency of the target database and reducing the risk of access vulnerability caused by the risk field.

[0079] As an optional embodiment, the specific manner in which the prediction module predicts the key attention field in the access request based on the neural network model includes: determining at least one universal field based on a plurality of historical access records of the target user; determining other fields in the access request except the universal field as to-be-predicted fields; inputting the to-be-predicted fields into the trained risk field identification neural network to obtain the key attention field in the access request.

[0080] It can be seen that, through the above optional embodiments, by determining the universal field based on the target user's historical access records and inputting the remaining fields into the risk field identification neural network to predict the focus field, the accuracy and pertinence of the focus field identification are improved based on the precise access strategy determination, reliable basis is provided for field risk analysis, and the access security risk caused by improper field screening is reduced.

[0081] As an optional embodiment, the specific manner in which the prediction module determines at least one universal field based on a plurality of historical access records of the target user comprises: obtaining a plurality of historical access records of the target user; filtering out the historical access records that successfully access the database to obtain a plurality of successful access records; calculating the intersection of the field types of the historical access requests in all successful access records to obtain at least one universal field.

[0082] It can be seen that, through the above optional embodiments, the universal field is determined by filtering the target user's successful access records and calculating the intersection of the field types of the historical access requests, thereby improving the accuracy and representativeness of the universal field extraction based on the precise focus field prediction, providing high-quality historical data support for the determination of the to-be-predicted field, and reducing the risk of field classification errors caused by incomplete historical records.

[0083] As an optional embodiment, the risk field identification neural network is a CNN network architecture, which is trained by a training data set including a plurality of training field data and corresponding risk attention degree labels.

[0084] It can be seen that, through the above optional embodiments, the details of the risk field identification neural network are limited to accurately identify the focus field later, assist in realizing precise database access control based on the focus field and risk assessment, improve the security and access efficiency of the target database, and reduce the risk of access vulnerabilities caused by risk fields.

[0085] As an optional embodiment, the specific manner in which the analysis module analyzes the field risk corresponding to the focus field according to a plurality of historical access records related to the target database comprises: determining a plurality of similar databases similar to the target database in a preset database set; traversing the records of dangerous access situations in the historical access records of all similar databases to obtain a plurality of dangerous access records; for each focus field, calculating the similarity between each request field in each dangerous access request in each dangerous access record and the focus field; screening the request fields with the similarity greater than the first similarity threshold to obtain the dangerous fields; determining the average of the similarity corresponding to all the dangerous fields as the field risk corresponding to the field of interest.

[0086] It can be seen that, through the above optional embodiments, the field risk is determined by screening the similar databases to the target database and analyzing the similarity of the request fields and the field of interest in the dangerous access records, thereby improving the comprehensiveness and accuracy of the field risk evaluation based on the precise access strategy determination, providing reliable risk quantification for the access control decision, and reducing the risk of database leakage caused by risk misjudgment.

[0087] As an optional embodiment, the parameter similarity between the database parameters corresponding to the similar database and the database parameters of the target database is greater than a preset second similarity threshold; the database parameters include at least one of database storage location, database size, database data type, database architecture, and database language type.

[0088] It can be seen that, through the above optional embodiments, the screening details of the similar databases are limited to accurately analyze the risk degree of the risk fields in the subsequent, thereby assisting in realizing the precise database access control based on the field of interest and the risk evaluation, improving the security and access efficiency of the target database, and reducing the access vulnerability risk caused by the risk fields.

[0089] As an optional embodiment, the access strategy includes access parameters and access permissions; the access parameters include access encryption degree, access container, and access transfer parameters.

[0090] It can be seen that, through the above optional embodiments, the parameter details of the access strategy are limited to accurately guide the access mode of the user in the subsequent, thereby assisting in realizing the precise database access control based on the field of interest and the risk evaluation, improving the security and access efficiency of the target database, and reducing the access vulnerability risk caused by the risk fields.

[0091] As an optional embodiment, the determining module determines the specific way of the access strategy when the target user accesses the target database according to the field risk, including: calculating the average of the field risks of all the fields of interest to obtain an access risk value; determining whether the access risk value is greater than a preset first risk value threshold to obtain a first determination result; if the first determination result is yes, determining that the access permission is not allowed to access; If the first determination result is no, it is determined that the access permission is permission access, and it is determined whether the access risk value is less than a preset second risk value threshold to obtain a second determination result; optionally, the second risk value threshold is less than the first risk value threshold. If the second determination result is yes, the access parameter is determined as the access parameter corresponding to the target database for direct access. If the second determination result is no, the access parameter corresponding to the security level is determined in the preset risk value and parameter corresponding relationship according to the access risk value.

[0092] It can be seen that, through the optional embodiments described above, the access permission and parameter are determined by calculating the average risk value of the key attention field as the access risk value and based on threshold determination, thereby improving the flexibility and security of access decision through multi-threshold grading and risk corresponding relationship on the basis of accurate access strategy determination, providing adaptive control for target user database access, and reducing the risk of improper access caused by improper risk value evaluation.

[0093] Embodiment three Please refer to Figure 3 , Figure 3 The AI security monitoring system based on database access analysis disclosed in the embodiments of the present application is another AI security monitoring system based on database access analysis. Figure 3 The AI security monitoring system based on database access analysis described is applied in a data processing system / data processing device / data processing server (wherein the server includes a local processing server or a cloud processing server). As shown in Figure 3 The AI security monitoring system based on database access analysis can include: a memory 301 storing executable program codes; a processor 302 coupled with the memory 301; The processor 302 calls the executable program codes stored in the memory 301, and is used to execute the steps of the AI security monitoring method based on database access analysis described in embodiment one.

[0094] Embodiment four The embodiments of the present application disclose a computer readable storage medium storing a computer program for electronic data exchange, wherein the computer program causes a computer to execute the steps of the AI security monitoring method based on database access analysis described in embodiment one.

[0095] Embodiment five The embodiments of the present application disclose a computer program product, which includes a non-transitory computer readable storage medium storing a computer program, and the computer program is operable to cause a computer to execute the steps of the AI security monitoring method based on database access analysis described in embodiment one.

[0096] The above-described embodiments of the present specification are described with reference to particular embodiments. Other embodiments are within the scope of the following claims. In some cases, actions recited in the claims can be performed in a different order and still achieve desirable results. Additionally, the processes depicted in the accompanying figures do not necessarily require the particular order shown or sequential order to achieve the desired results. In certain implementations, multitasking and parallel processing can be advantageous.

[0097] The systems, apparatuses, modules, or units illustrated by the above-described embodiments can be specifically realized by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer can be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0098] For the convenience of description, the above apparatuses are described in various units by functions respectively when described. Of course, the functions of each unit can be realized in the same or more software and / or hardware when implementing the present specification.

[0099] Those skilled in the art will understand that the embodiments of the present specification can be provided as a method, a system, or a computer program product. Therefore, the embodiments of the present specification can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the embodiments of the present specification can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, etc.) containing computer usable program code.

[0100] The present specification is described with reference to flowcharts and / or block diagrams of methods, apparatuses (systems), and computer program products according to embodiments of the present specification. It should be understood that each flow and / or block in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing apparatus to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing apparatus produce a machine that implements the functions specified in the flowcharts and / or block diagrams. Figure 1 The functions specified in a flow or multiple flows and / or blocks Figure 1 The apparatuses specified in a flow or multiple flows and / or blocks

[0101] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the Figure 1 function specified in the flow or flows and / or blocks Figure 1 of the block or blocks.

[0102] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the Figure 1 function specified in the flow or flows and / or blocks Figure 1 of the block or blocks.

[0103] In one typical configuration, the computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0104] The memory can include non-persistent memory and / or volatile memory, such as random access memory (RAM) and / or cache memory, non-volatile memory, such as read-only memory (ROM), EPROM, and / or flash memory, etc. The memory is an example of computer readable media.

[0105] Computer readable media includes permanent and non-permanent, moveable and non- moveable media that can be implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disks (DVDs) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information that is accessible to a computing device. According to the definition provided herein, computer readable media does not include transitory media, such as modulated data signals and carrier waves.

[0106] It should also be noted that the terms "comprises", "comprising", or any other variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. An element proceeded by "comprises... a" does not, without further constraints, exclude the presence of additional identical elements in the process, method, article, or apparatus that comprises the element.

[0107] The specification can be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform particular tasks or implement particular abstract data types. The specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules can be located in both local and remote computer storage media including memory storage devices.

[0108] The various embodiments in the specification are described in progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the difference from other embodiments. In particular, for the system embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the part of the method embodiments.

[0109] Finally, it should be noted that the AI security monitoring method and system based on database access analysis disclosed by the embodiments of the present application are only the preferred embodiments of the present application, and are used to illustrate the technical solutions of the present application, but not to limit them. Although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that the technical solutions recorded in the foregoing embodiments can be modified, or some technical features can be replaced by equivalent ones. The modification or replacement does not make the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. An AI security monitoring method based on database access analysis, characterized by, The method comprises: obtaining an access request of a target user to a target database; predicting a field of focus in the access request based on a neural network model; analyzing a field risk corresponding to the field of focus according to a plurality of historical access records related to the target database; determining an access strategy of the target user when accessing the target database according to the field risk. 2.The AI security monitoring method based on database access analysis according to claim 1, wherein, The method comprises: determining at least one universal field based on a plurality of historical access records of the target user; determining other fields in the access request except the universal field as to-be-predicted fields; inputting the to-be-predicted fields into a trained risk field identification neural network to obtain the field of focus in the access request. 3.The AI security monitoring method based on database access analysis according to claim 2, characterized in that, The method comprises: obtaining a plurality of historical access records of the target user; screening the historical access records that successfully access the database to obtain a plurality of successful access records; calculating an intersection of field types of historical access requests in all the successful access records to obtain at least one universal field. 4.The AI security monitoring method based on database access analysis according to claim 2, wherein, The risk field identification neural network is a CNN network architecture and is trained by a training data set comprising a plurality of training field data and corresponding risk attention degree labels. 5.The AI security monitoring method based on database access analysis according to claim 1, wherein, The method comprises: determining a plurality of similar databases similar to the target database in a preset database set; traversing records of dangerous access situations in historical access records of all the similar databases to obtain a plurality of dangerous access records; for each field of focus, calculating a similarity between each request field in each dangerous access request in each dangerous access record and the field of focus; screening the request fields with a similarity greater than a preset first similarity threshold to obtain dangerous fields; determining an average value of the similarity corresponding to all the dangerous fields as a field risk corresponding to the field of focus.

6. The AI security monitoring method based on database access analysis according to claim 5, characterized in that, The parameter similarity between database parameters corresponding to the similar databases and database parameters of the target database is greater than a preset second similarity threshold; the database parameters comprise at least one of a database storage location, a database size, a database data type, a database architecture, and a database language type.

7. The AI security monitoring method based on database access analysis according to claim 1, characterized in that, The access strategy comprises an access parameter and an access permission; the access parameter comprises an access encryption degree, an access container, and an access transfer parameter. 8.The AI security monitoring method based on database access analysis according to claim 7, wherein, The method comprises: calculating an average value of the field risks of all the fields of focus to obtain an access risk value; judging whether the access risk value is greater than a preset first risk value threshold to obtain a first judgment result; if the first judgment result is yes, determining that the access permission is not allowed to access. If the first determination result is no, it is determined that the access permission is permission access, and it is determined whether the access risk value is less than a preset second risk value threshold to obtain a second determination result; the second risk value threshold is less than the first risk value threshold; If the second determination result is yes, the access parameter is determined to be an access parameter corresponding to direct access to the target database; If the second determination result is no, the access parameter corresponding to the security level is determined in a preset risk value and parameter corresponding relationship according to the access risk value.

9. An AI security monitoring system based on database access analysis, characterized by, The system comprises: An acquisition module configured to acquire an access request of a target user to a target database; A prediction module configured to predict a key field of interest in the access request based on a neural network model; An analysis module configured to analyze a field risk corresponding to the key field of interest according to a plurality of historical access records related to the target database; A determination module configured to determine an access strategy of the target user when accessing the target database according to the field risk.

10. An AI security monitoring system based on database access analysis, characterized by, The system comprises: A memory storing executable program code; A processor coupled with the memory; The processor invokes the executable program code stored in the memory to execute the AI security monitoring method based on database access analysis according to any one of claims 1-8.

Images