AI security monitoring method and system based on database access analysis

Abstract

The application discloses an AI security monitoring method and system based on database access analysis, and the method comprises the following steps: obtaining an access request of a target user to a target database; predicting a key field of attention in the access request based on a neural network model; analyzing a field risk corresponding to the key field of attention according to a plurality of historical access records related to the target database; and determining an access strategy of the target user when accessing the target database according to the field risk. It can be seen that the application can realize precise database access control based on the key field of attention and risk assessment, improve the security and access efficiency of the target database, and reduce the risk of access vulnerabilities caused by risk fields.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, and in particular to an AI security monitoring method and system based on database access analysis. BACKGROUND

[0002] With the rapid growth of data security and efficient access demand, enterprises and institutions pay more and more attention to protecting sensitive information through precise database access control, and how to effectively identify high-risk fields and optimize access strategies becomes a key technical problem. The existing technology usually collects user access requests to the database, assigns access permissions by using fixed permission rules or simple log analysis methods, and manages database access based on standard strategies to ensure data security. The existing solutions lack dynamic prediction of key focus fields and risk analysis of historical access records, making it difficult to accurately assess field risks and develop targeted access strategies, resulting in insufficient database security, easy exposure of risk fields, and limited access efficiency and data protection effect. Therefore, the existing technology has defects and needs to be solved. SUMMARY

[0003] The technical problem to be solved by the present application is to provide an AI security monitoring method and system based on database access analysis, which can realize precise database access control based on key focus fields and risk assessment, improve the security and access efficiency of the target database, and reduce the risk of access vulnerabilities caused by risk fields.

[0004] To solve the above technical problems, the first aspect of the present application discloses an AI security monitoring method based on database access analysis, which comprises:

[0005] Obtaining an access request of a target user to a target database;

[0006] Based on a neural network model, predicting a key focus field in the access request;

[0007] According to a plurality of historical access records related to the target database, analyzing the field risk corresponding to the key focus field;

[0008] According to the field risk, determining an access strategy when the target user accesses the target database.

[0009] As an optional implementation, in the first aspect of the present application, the neural network model is used to predict the key focus field in the access request, which comprises:

[0010] Based on a plurality of historical access records of the target user, at least one universal field is determined;

[0011] determining other fields in the access request except the universal field as to-be-predicted fields;

[0012] inputting the to-be-predicted fields into the trained risk field identification neural network to obtain a field of focus in the access request.

[0013] As an optional implementation, in the first aspect of the present application, the determining of the at least one universal field based on the plurality of historical access records of the target user comprises:

[0014] obtaining the plurality of historical access records of the target user;

[0015] screening the historical access records of successful access to the database to obtain a plurality of successful access records;

[0016] calculating the intersection of the field types of the historical access requests in all the successful access records to obtain at least one universal field.

[0017] As an optional implementation, in the first aspect of the present application, the risk field identification neural network is a CNN network architecture, and is trained by a training data set comprising a plurality of training field data and corresponding risk attention degree labels.

[0018] As an optional implementation, in the first aspect of the present application, the analyzing of the field risk corresponding to the field of focus according to the plurality of historical access records related to the target database comprises:

[0019] determining a plurality of similar databases similar to the target database in a preset database set;

[0020] traversing records of dangerous access in the historical access records of all the similar databases to obtain a plurality of dangerous access records;

[0021] for each field of focus, calculating the similarity between each request field of each dangerous access request in each dangerous access record and the field of focus;

[0022] screening the request fields with the similarity greater than a preset first similarity threshold to obtain dangerous fields;

[0023] determining the average value of the similarity corresponding to all the dangerous fields as the field risk corresponding to the field of focus.

[0024] As an optional implementation, in the first aspect of the present application, the parameter similarity between the database parameters corresponding to the similar database and the database parameters of the target database is greater than a preset second similarity threshold; the database parameters include at least one of database storage location, database size, database data type, database architecture and database language type.

[0025] As an optional implementation, in the first aspect of the present application, the access strategy includes access parameters and access permissions; the access parameters include access encryption level, access container and access transfer parameters.

[0026] As an optional implementation, in the first aspect of the present application, the determination of the access strategy of the target user when accessing the target database according to the field risk includes:

[0027] Calculating the average value of the field risk of all the fields of interest to obtain an access risk value;

[0028] Judging whether the access risk value is greater than a preset first risk value threshold to obtain a first judgment result;

[0029] If the first judgment result is yes, it is determined that the access permission is not allowed to access;

[0030] If the first judgment result is no, it is determined that the access permission is allowed to access, and it is judged whether the access risk value is less than a preset second risk value threshold to obtain a second judgment result; the second risk value threshold is less than the first risk value threshold;

[0031] If the second judgment result is yes, it is determined that the access parameters are the access parameters corresponding to directly accessing the target database;

[0032] If the second judgment result is no, the access parameters corresponding to the security level are determined according to the access risk value in a preset risk value and parameter corresponding relationship.

[0033] The second aspect of the embodiment of the present application discloses an AI security monitoring system based on database access analysis, and the system includes:

[0034] An acquisition module is configured to acquire an access request of a target user to a target database;

[0035] A prediction module is configured to predict a field of interest in the access request based on a neural network model;

[0036] An analysis module is configured to analyze a field risk corresponding to the field of interest according to a plurality of historical access records related to the target database;

[0037] determining a field risk of each field in the access request;

[0038] As an optional implementation, in the second aspect of the present application, the prediction module predicts the specific way of the focus field in the access request based on a neural network model, which comprises:

[0039] determining at least one universal field based on the plurality of historical access records of the target user;

[0040] determining other fields in the access request except the universal field as the predicted field;

[0041] inputting the predicted field into the trained risk field identification neural network to obtain the focus field in the access request.

[0042] As an optional implementation, in the second aspect of the present application, the prediction module determines at least one universal field based on the plurality of historical access records of the target user, which comprises:

[0043] obtaining the plurality of historical access records of the target user;

[0044] filtering the historical access records to obtain a plurality of successful access records;

[0045] calculating the intersection of the field types of the historical access requests in all the successful access records to obtain at least one universal field.

[0046] As an optional implementation, in the second aspect of the present application, the risk field identification neural network is a CNN network architecture, which is trained by a training data set comprising a plurality of training field data and corresponding risk attention degree labels.

[0047] As an optional implementation, in the second aspect of the present application, the analysis module analyzes the specific way of the field risk corresponding to the focus field based on the plurality of historical access records related to the target database, which comprises:

[0048] determining a plurality of similar databases similar to the target database in a preset database set;

[0049] traversing the records of dangerous access in the historical access records of all the similar databases to obtain a plurality of dangerous access records;

[0050] for each focus field, calculating the similarity between each request field of each dangerous access request in each dangerous access record and the focus field.

[0051] screening the request field with the similarity greater than the preset first similarity threshold value to obtain a dangerous field;

[0052] determining an average value of the similarity corresponding to all the dangerous fields as a field risk corresponding to the field of focus.

[0053] As an optional implementation, in the second aspect of the present application, the parameter similarity between the database parameters corresponding to the similarity database and the database parameters of the target database is greater than a preset second similarity threshold value; the database parameters include at least one of database storage location, database size, database data type, database architecture and database language type.

[0054] As an optional implementation, in the second aspect of the present application, the access strategy includes an access parameter and an access permission; the access parameter includes an access encryption degree, an access container and an access transfer parameter.

[0055] As an optional implementation, in the second aspect of the present application, the determining module determines the specific manner of the access strategy when the target user accesses the target database according to the field risk, including:

[0056] calculating an average value of the field risk of all the fields of focus to obtain an access risk value;

[0057] judging whether the access risk value is greater than a preset first risk value threshold value to obtain a first judgment result;

[0058] if the first judgment result is yes, determining that the access permission is not allowed to access;

[0059] if the first judgment result is no, determining that the access permission is allowed to access, and judging whether the access risk value is less than a preset second risk value threshold value to obtain a second judgment result; the second risk value threshold value is less than the first risk value threshold value;

[0060] if the second judgment result is yes, determining that the access parameter is an access parameter corresponding to directly accessing the target database;

[0061] if the second judgment result is no, determining the access parameter corresponding to the security degree in a preset risk value and parameter corresponding relationship according to the access risk value.

[0062] A third aspect of the present application discloses another AI security monitoring system based on database access analysis, the system comprising:

[0063] a memory storing executable program code;

[0064] a processor coupled with the memory;

[0065] The processor invokes the executable program code stored in the memory to execute part or all of the steps of the AI security monitoring method based on database access analysis disclosed in the first aspect of the application.

[0066] The fourth aspect of the application discloses a computer storage medium, which stores computer instructions, and when the computer instructions are invoked, part or all of the steps of the AI security monitoring method based on database access analysis disclosed in the first aspect of the application are executed.

[0067] Compared with the prior art, the embodiments of the application have the following beneficial effects:

[0068] The application can realize precise database access control based on the key attention field and risk assessment, improve the security and access efficiency of the target database, and reduce the risk of access vulnerabilities caused by risk fields. BRIEF DESCRIPTION OF DRAWINGS

[0069] In order to more clearly illustrate the technical solutions in the embodiments of the application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the application, and other drawings can be obtained by those skilled in the art without creative labor.

[0070] Figure 1 is a flowchart of an AI security monitoring method based on database access analysis disclosed by the embodiments of the application.

[0071] Figure 2 is a structural diagram of an AI security monitoring system based on database access analysis disclosed by the embodiments of the application.

[0072] Figure 3 is a structural diagram of another AI security monitoring system based on database access analysis disclosed by the embodiments of the application. DETAILED DESCRIPTION

[0073] In the following, the technical solutions in the embodiments of the present application will be described clearly and completely in conjunction with the drawings in the embodiments of the present application, so that those skilled in the art can better understand the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of the present application.

[0074] The terms "first", "second", and the like in the specification and claims of the present application and the above-described drawings are used to distinguish different objects, and are not used to describe a particular order. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, device, product, or equipment that includes a series of steps or units is not limited to the listed steps or units, but can optionally include steps or units not listed, or can optionally include other steps or units inherent to the process, method, product, or equipment.

[0075] Reference herein to "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the present application. The phrase appears at various places in the specification does not necessarily all refer to the same embodiment, nor is it necessarily mutually exclusive of other embodiments. It is explicitly and implicitly understood that the embodiments described herein can be combined with other embodiments.

[0076] The present application discloses an AI security monitoring method and system based on database access analysis, which can realize precise database access control based on key attention fields and risk assessment, improve the security and access efficiency of the target database, and reduce the risk of access vulnerabilities caused by risk fields by obtaining the access request of the target user to the target database and predicting the key attention field based on the neural network model, analyzing the field risk in combination with the historical access record, and determining the access strategy.

[0077] Embodiment one

[0078] Please refer to Figure 1 , Figure 1 is a flowchart of an AI security monitoring method based on database access analysis disclosed by the embodiments of the present application. Among them, Figure 1 The AI security monitoring method based on database access analysis described can be applied in a data processing system / data processing device / data processing server (wherein the server includes a local processing server or a cloud processing server). As Figure 1 shown, the AI security monitoring method based on database access analysis can include the following operations:

[0079] 101. Obtain an access request of a target user to a target database.

[0080] Optionally, the access request can include a query statement, a field list, an operation type, or user identity information, without limitation of the present application.

[0081] Optionally, the target database can be a relational database, a non-relational database, or a distributed database, without limitation of the present application.

[0082] Optionally, the obtaining process can be implemented based on an API call, a database interface, user input, or log capture, without limitation of the present application.

[0083] 102. Predict a key focus field in the access request based on a neural network model.

[0084] Optionally, the neural network model can be a convolutional neural network, a recurrent neural network, or a Transformer model, without limitation of the present application.

[0085] Optionally, the key focus field can be a key query field, a sensitive data field, or a high-frequency access field, without limitation of the present application.

[0086] 103. Analyze a field risk corresponding to the key focus field according to a plurality of historical access records related to the target database.

[0087] Optionally, the historical access records can include access time, access fields, access results, or user behavior data, without limitation of the present application.

[0088] Optionally, the field risk can be a risk score, a sensitivity level, or an abnormal probability, without limitation of the present application.

[0089] Optionally, the analysis process can be implemented based on statistical analysis, pattern recognition, or a machine learning algorithm, without limitation of the present application.

[0090] 104. Determine an access strategy of the target user when accessing the target database according to the field risk.

[0091] Optionally, the access strategy can include access permission, access parameters, access restrictions, or log recording rules, without limitation of the present application.

[0092] As can be seen, the above embodiments of the present application can obtain an access request of a target user to a target database, predict a key focus field based on a neural network model, analyze a field risk in combination with historical access records, and determine an access strategy, thereby enabling precise database access control based on the key focus field and risk assessment, improving the security and access efficiency of the target database, and reducing the risk of access vulnerabilities caused by risk fields.

[0093] As an optional embodiment, in the above step, the key field in the access request is predicted based on the neural network model, including:

[0094] At least one universal field is determined based on the plurality of historical access records of the target user;

[0095] Fields in the access request other than the universal field are determined as to-be-predicted fields;

[0096] The to-be-predicted fields are input into the trained risk field identification neural network to obtain the key field in the access request.

[0097] Optionally, the universal field can be a high-frequency access field, a non-sensitive field, or a public field, which is not limited by the present application.

[0098] Optionally, the historical access record can be a single user record, a group user record, or a time period record, which is not limited by the present application.

[0099] As can be seen, through the above optional embodiment, the universal field is determined based on the historical access records of the target user, and the remaining fields are input into the risk field identification neural network to predict the key field, thereby improving the accuracy and pertinence of the key field identification based on the precise access strategy determination, providing a reliable basis for field risk analysis, and reducing the access security risks caused by improper field screening.

[0100] As an optional embodiment, in the above step, at least one universal field is determined based on the plurality of historical access records of the target user, including:

[0101] Obtaining a plurality of historical access records of the target user;

[0102] Filtering the historical access records of successful access to the database to obtain a plurality of successful access records;

[0103] Calculating the intersection of the field types of the historical access requests in all successful access records to obtain at least one universal field.

[0104] Optionally, the historical access record can include an access timestamp, a request field, an access result, or user identity information, which is not limited by the present application.

[0105] Optionally, the obtaining process can be based on a database log, user behavior tracking, or a data interface, which is not limited by the present application.

[0106] Optionally, the successful access record can be an error-free record, an anomaly-free record, or a normal completion record, which is not limited by the present application.

[0107] Optionally, the field type can be a data type, a field name, or a field purpose, which is not limited by the present application.

[0108] Optionally, the intersection calculation process can be implemented based on set operation, statistical analysis, or pattern matching, which is not limited by the present application.

[0109] As can be seen, through the above optional embodiments, the universal field is determined by screening the target user successful access records and calculating the intersection of the historical access request field types, thereby improving the accuracy and representativeness of the universal field extraction based on the precise focus field prediction, providing high-quality historical data support for the to-be-predicted field determination, and reducing the risk of field classification errors caused by incomplete historical records.

[0110] As an optional embodiment, in the above step, the risk field identification neural network is a CNN network architecture, which is trained by a training data set including a plurality of training field data and corresponding risk attention degree labels.

[0111] As can be seen, through the above optional embodiments, the details of the risk field identification neural network are limited to accurately identify the focus field in the subsequent process, assist in implementing precise database access control based on the focus field and risk assessment, improve the security and access efficiency of the target database, and reduce the risk of access vulnerabilities caused by risk fields.

[0112] As an optional embodiment, in the above step, the field risk corresponding to the focus field is analyzed according to a plurality of historical access records related to the target database, including:

[0113] A plurality of similar databases similar to the target database are determined in a preset database set;

[0114] Records of dangerous access situations in the historical access records of all similar databases are traversed to obtain a plurality of dangerous access records;

[0115] For each focus field, the similarity between each request field in each dangerous access request in each dangerous access record and the focus field is calculated;

[0116] Request fields with a similarity greater than a preset first similarity threshold are filtered out to obtain dangerous fields;

[0117] The average value of the similarities corresponding to all dangerous fields is determined as the field risk corresponding to the focus field.

[0118] Optionally, the similar database can be determined based on a database structure, a data type, or an access mode, which is not limited by the present application.

[0119] Optionally, the similarity database determination process can be implemented based on similarity calculation, cluster analysis or rule matching, without limitation of the present application.

[0120] Optionally, the dangerous access situation can be unauthorized access, abnormal query or data leakage, without limitation of the present application.

[0121] Optionally, the traversal process can be implemented based on log scanning, anomaly detection or data filtering, without limitation of the present application.

[0122] Optionally, the similarity can be cosine similarity, Jaccard coefficient or semantic similarity, without limitation of the present application.

[0123] Optionally, the first similarity threshold can be a fixed threshold, a dynamic threshold or a threshold adjusted based on field sensitivity, without limitation of the present application.

[0124] As can be seen, through the above optional embodiments, the field risk is determined by screening the similar databases to the target database and analyzing the similarity between the request fields in the dangerous access records and the fields of interest, thereby improving the comprehensiveness and accuracy of the field risk assessment based on the accurate access strategy determination, providing reliable risk quantification for the access control decision, and reducing the risk of database leakage caused by risk misjudgment.

[0125] As an optional embodiment, in the above steps, the parameter similarity between the database parameters corresponding to the similar databases and the database parameters of the target database is greater than a preset second similarity threshold; the database parameters include at least one of database storage location, database size, database data type, database architecture and database language type.

[0126] Optionally, the parameter similarity can be cosine similarity, Jaccard coefficient or semantic similarity, without limitation of the present application.

[0127] As can be seen, through the above optional embodiments, the screening details of the similar databases are limited to facilitate the subsequent accurate analysis of the risk degree of the risk fields, assist in realizing the accurate database access control based on the fields of interest and risk assessment, improve the security and access efficiency of the target database, and reduce the access vulnerability risk caused by the risk fields.

[0128] As an optional embodiment, in the above steps, the access strategy includes access parameters and access permissions; the access parameters include access encryption level, access container and access transfer parameters.

[0129] Optionally, the access container can be an access container construction method or a parameter of a constructed container.

[0130] Optionally, the access transit parameter can be a parameter of a route, a parameter of a node, and a number of nodes through which the target database is forwarded by an intermediate node when the target database is accessed.

[0131] It can be seen that, by the above optional embodiments, the parameter details of the access strategy are limited to accurately guide the access mode of the user subsequently, to assist in realizing the precise database access control based on the focus field and the risk assessment, to improve the security and access efficiency of the target database, and to reduce the access vulnerability risk caused by the risk field.

[0132] As an optional embodiment, in the above step, the access strategy of the target user when accessing the target database is determined according to the field risk, comprising:

[0133] calculating an average value of the field risks of all the focus fields to obtain an access risk value;

[0134] determining whether the access risk value is greater than a preset first risk value threshold to obtain a first determination result;

[0135] if the first determination result is yes, it is determined that the access permission is not allowed to access;

[0136] if the first determination result is no, it is determined that the access permission is allowed to access, and it is determined whether the access risk value is less than a preset second risk value threshold to obtain a second determination result; optionally, the second risk value threshold is less than the first risk value threshold;

[0137] if the second determination result is yes, the access parameter is determined to be an access parameter corresponding to directly accessing the target database;

[0138] if the second determination result is no, the access parameter corresponding to the security degree is determined in a preset corresponding relationship between the risk value and the parameter according to the access risk value.

[0139] Optionally, the first risk value threshold and the second risk value threshold can be fixed thresholds, dynamic thresholds, or thresholds adjusted based on the sensitivity of the database, which are not limited by the present application.

[0140] Optionally, the not allowed to access can be completely refused, temporarily limited, or required to be additionally authenticated, which is not limited by the present application.

[0141] Optionally, the corresponding relationship can be a mapping table, a rule library, or a data-driven model, which is not limited by the present application.

[0142] It can be seen that, through the above optional embodiments, the risk average value of the key attention field is calculated as the access risk value, and the access permission and parameters are determined based on the threshold judgment, so as to optimize and improve the flexibility and security of the access decision based on the accurate access strategy determination, provide adaptive control for the target user database access, and reduce the risk of improper access caused by improper risk value evaluation.

[0143] Embodiment two

[0144] Please refer to Figure 2 , Figure 2 is a structural schematic diagram of an AI security monitoring system based on database access analysis disclosed by an embodiment of the application. Among them, Figure 2 The AI security monitoring system based on database access analysis described can be applied in a data processing system / data processing device / data processing server (wherein the server includes a local processing server or a cloud processing server). As Figure 2 indicated, the AI security monitoring system based on database access analysis can include:

[0145] The acquisition module 201 is configured to acquire an access request of a target user to a target database.

[0146] The prediction module 202 is configured to predict a key attention field in the access request based on a neural network model.

[0147] The analysis module 203 is configured to analyze a field risk corresponding to the key attention field according to a plurality of historical access records related to the target database.

[0148] The determination module 204 is configured to determine an access strategy when the target user accesses the target database according to the field risk.

[0149] It can be seen that the above-mentioned embodiments of the application can realize accurate database access control based on the key attention field and risk assessment by acquiring the access request of the target user to the target database and predicting the key attention field based on the neural network model, analyzing the field risk in combination with the historical access records and determining the access strategy, thereby improving the security and access efficiency of the target database and reducing the risk of access vulnerability caused by the risk field.

[0150] As an optional embodiment, the specific manner in which the prediction module predicts the key attention field in the access request based on the neural network model includes:

[0151] At least one universal field is determined based on a plurality of historical access records of the target user;

[0152] Other fields in the access request except the universal field are determined as to-be-predicted fields;

[0153] inputting the to-be-predicted field into the trained risk field identification neural network to obtain a field of interest in the access request.

[0154] It can be seen that, by the above optional embodiments, by determining the universal field based on the historical access records of the target user and inputting the remaining fields into the risk field identification neural network to predict the field of interest, the accuracy and pertinence of the identification of the field of interest are improved based on the accurate access strategy determination, reliable basis is provided for the field risk analysis, and the access security risk caused by improper field screening is reduced.

[0155] As an optional embodiment, the specific manner in which the prediction module determines at least one universal field based on the plurality of historical access records of the target user comprises:

[0156] obtaining a plurality of historical access records of the target user;

[0157] screening the historical access records of successful access to the database to obtain a plurality of successful access records;

[0158] calculating the intersection of the field types of the historical access requests in all the successful access records to obtain at least one universal field.

[0159] It can be seen that, by the above optional embodiments, the universal field is determined by screening the successful access records of the target user and calculating the intersection of the field types of the historical access requests, so as to improve the accuracy and representativeness of the extraction of the universal field based on the accurate prediction of the field of interest, provide high-quality historical data support for the determination of the to-be-predicted field, and reduce the risk of field classification errors caused by incomplete historical records.

[0160] As an optional embodiment, the risk field identification neural network is a CNN network architecture, which is trained by a training data set comprising a plurality of training field data and corresponding risk attention degree labels.

[0161] It can be seen that, by the above optional embodiments, the details of the risk field identification neural network are limited to accurately identify the field of interest in the subsequent process, assist in realizing accurate database access control based on the field of interest and risk assessment, improve the security and access efficiency of the target database, and reduce the risk of access vulnerabilities caused by risk fields.

[0162] As an optional embodiment, the specific manner in which the analysis module analyzes the field risk corresponding to the field of interest based on the plurality of historical access records related to the target database comprises:

[0163] determining a plurality of similar databases similar to the target database in a preset database set;

[0164] traversing all the records of dangerous access situations in the historical access records of the similar databases, to obtain a plurality of dangerous access records;

[0165] for each field of interest, calculating the similarity between each request field in each dangerous access request in each dangerous access record and the field of interest;

[0166] screening the request fields with a similarity greater than a preset first similarity threshold, to obtain dangerous fields;

[0167] determining the average value of the similarities of all the dangerous fields as the field risk corresponding to the field of interest.

[0168] It can be seen that, through the above optional embodiments, the field risk is determined by screening similar databases to the target database and analyzing the similarity between the request fields in the dangerous access records and the fields of interest, thereby improving the comprehensiveness and accuracy of the field risk assessment based on the precise access strategy determination, providing reliable risk quantification for the access control decision, and reducing the risk of database leakage caused by risk misjudgment.

[0169] As an optional embodiment, the parameter similarity between the database parameters corresponding to the similar databases and the database parameters of the target database is greater than a preset second similarity threshold; the database parameters include at least one of a database storage location, a database size, a database data type, a database architecture, and a database language type.

[0170] It can be seen that, through the above optional embodiments, the screening details of the similar databases are limited to facilitate the subsequent accurate analysis of the risk degree of the risk fields, to assist in realizing the precise database access control based on the fields of interest and the risk assessment, to improve the security and access efficiency of the target database, and to reduce the access vulnerability risk caused by the risk fields.

[0171] As an optional embodiment, the access strategy includes an access parameter and an access permission; the access parameter includes an access encryption degree, an access container, and an access transfer parameter.

[0172] It can be seen that, through the above optional embodiments, the parameter details of the access strategy are limited to accurately guide the access mode of the user in the subsequent process, to assist in realizing the precise database access control based on the fields of interest and the risk assessment, to improve the security and access efficiency of the target database, and to reduce the access vulnerability risk caused by the risk fields.

[0173] As an optional embodiment, the determining module determines the specific way of the access strategy when the target user accesses the target database according to the field risk, including:

[0174] calculating an average value of the field risks of all the fields of focus, to obtain an access risk value;

[0175] determining whether the access risk value is greater than a preset first risk value threshold, to obtain a first determination result;

[0176] if the first determination result is yes, determining that the access permission is not permitted access;

[0177] if the first determination result is no, determining that the access permission is permitted access, and determining whether the access risk value is less than a preset second risk value threshold, to obtain a second determination result; optionally, the second risk value threshold is less than the first risk value threshold;

[0178] if the second determination result is yes, determining that the access parameter is an access parameter corresponding to the target database for direct access;

[0179] if the second determination result is no, determining an access parameter corresponding to a security level according to the access risk value in a preset risk value and parameter corresponding relationship.

[0180] It can be seen that, through the optional embodiments described above, the access permission and parameter are determined based on the threshold judgment by calculating the average value of the field risks of the fields of focus as the access risk value, thereby improving the flexibility and security of the access decision through multi-threshold grading and risk corresponding relationship on the basis of the precise access strategy determination, providing adaptive control for the target user database access, and reducing the risk of improper access caused by improper risk value evaluation.

[0181] Embodiment Three

[0182] Please refer to Figure 3 , Figure 3 Another AI security monitoring system based on database access analysis is disclosed in the embodiments of the present application. Figure 3 The AI security monitoring system based on database access analysis described is applied in a data processing system / data processing device / data processing server (wherein the server includes a local processing server or a cloud processing server). As shown in Figure 3 The AI security monitoring system based on database access analysis can include:

[0183] a memory 301 storing executable program codes;

[0184] a processor 302 coupled with the memory 301;

[0185] The processor 302 calls the executable program codes stored in the memory 301, to execute the steps of the AI security monitoring method based on database access analysis described in Embodiment One.

[0186] Embodiment Four

[0187] The embodiment of the application discloses a computer readable storage medium which stores a computer program for electronic data exchange, wherein the computer program causes a computer to execute steps of the AI security monitoring method based on database access analysis described in embodiment one.

[0188] Embodiment five

[0189] The embodiment of the application discloses a computer program product, which comprises a non-transitory computer readable storage medium storing a computer program, and the computer program is operable to cause a computer to execute steps of the AI security monitoring method based on database access analysis described in embodiment one.

[0190] The above describes specific embodiments of the present specification, and other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different than the order in the embodiments and still achieve the desired result. In addition, the processes depicted in the figures do not necessarily have to be performed in the specific order shown and / or sequentially. In certain implementations, multitasking and parallel processing can be advantageous.

[0191] The systems, apparatuses, modules or units illustrated by the above embodiments can be specifically implemented by a computer chip or entity, or by a product with certain functions. A typical implementation device is a computer. Specifically, the computer may, for example, be a personal computer, a laptop computer, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0192] For the convenience of description, the above apparatus is described as various units respectively described in functions. Of course, the functions of each unit can be implemented in the same or more software and / or hardware in the implementation of the present specification.

[0193] Those skilled in the art should understand that the embodiments of the present specification can be provided as a method, a system or a computer program product. Therefore, the embodiments of the present specification can take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware aspects. Moreover, the embodiments of the present specification can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0194] The specification is presented with reference to flow diagrams and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the specification. It will be understood that each block of the flow diagrams and / or block diagrams, and combinations of blocks in the flow diagrams and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processing element or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flow diagrams and / or block diagrams block or blocks. Figure 1 The flow diagrams and / or block diagrams in the specification can present a method, apparatus or computer program product according to embodiments of the specification. Flow diagrams and / or block diagrams can also present a method, apparatus or computer program product to achieve functions specified in flow diagrams and / or block diagrams block or blocks. Figure 1 The flow diagrams and / or block diagrams in the specification can present a method, apparatus or computer program product according to embodiments of the specification. Flow diagrams and / or block diagrams can also present a method, apparatus or computer program product to achieve functions specified in flow diagrams and / or block diagrams block or blocks.

[0195] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the flow diagrams and / or block diagrams block or blocks. Figure 1 The flow diagrams and / or block diagrams in the specification can present a method, apparatus or computer program product according to embodiments of the specification. Flow diagrams and / or block diagrams can also present a method, apparatus or computer program product to achieve functions specified in flow diagrams and / or block diagrams block or blocks. Figure 1 The flow diagrams and / or block diagrams in the specification can present a method, apparatus or computer program product according to embodiments of the specification. Flow diagrams and / or block diagrams can also present a method, apparatus or computer program product to achieve functions specified in flow diagrams and / or block diagrams block or blocks.

[0196] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the flow diagrams and / or block diagrams block or blocks. Figure 1 The flow diagrams and / or block diagrams in the specification can present a method, apparatus or computer program product according to embodiments of the specification. Flow diagrams and / or block diagrams can also present a method, apparatus or computer program product to achieve functions specified in flow diagrams and / or block diagrams block or blocks. Figure 1 The flow diagrams and / or block diagrams in the specification can present a method, apparatus or computer program product according to embodiments of the specification. Flow diagrams and / or block diagrams can also present a method, apparatus or computer program product to achieve functions specified in flow diagrams and / or block diagrams block or blocks.

[0197] In one typical configuration, the computing device includes one or more processors (CPU's), input / output interfaces, network interfaces, and memory.

[0198] The memory can include non-persistent memory and / or persistent memory, both of which can be volatile and / or non-volatile. Non-persistent memory can include, for example, a random access memory (RAM), which can be a volatile memory device that can require power to maintain its state. Non-persistent memory can also include, for example, a cache, which can be a smaller, faster volatile memory either internal or external to a processor. Persistent memory can include, for example, a read-only memory (ROM), which can be a non-volatile memory device that can not require power to maintain its state. Persistent memory can also include, for example, a flash memory, which can be an external non-volatile memory that can not require power to maintain its state.

[0199] Computer-readable media includes permanent and non-permanent, movable and non-movable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible by a computing device. According to the definition herein, computer-readable media does not include transitory media such as modulated data signals and carriers.

[0200] It should also be noted that the terms "comprising", "containing", or any other variant thereof are intended to encompass non-exclusive inclusion, such that processes, methods, articles or devices that comprise a list of elements not only include those elements, but also include other elements not expressly listed or inherent to such processes, methods, articles or devices. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the process, method, article or device comprising the element.

[0201] The specification can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The specification can also be practiced in a distributed computing environment, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media, including storage devices.

[0202] Each embodiment in the specification is described in a progressive manner, and the same or similar parts between each embodiment can be referred to each other, and each embodiment focuses on the difference from other embodiments. In particular, for system embodiments, since they are basically similar to method embodiments, the description is relatively simple, and the relevant parts can be referred to the part of the method embodiment.

[0203] Finally, it should be noted that: the AI security monitoring method and system based on database access analysis disclosed in the embodiments of the present application are only the preferred embodiments of the present application, and are used to illustrate the technical solutions of the present application, but not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand; the technical solutions recorded in the foregoing embodiments can still be modified, or some technical features can be replaced; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. An AI security monitoring method based on database access analysis, characterized by, The method comprises: obtaining an access request of a target user to a target database; based on a neural network model, predicting a field of focus in the access request, comprising: obtaining a plurality of historical access records of the target user; screening the historical access records that successfully access the database to obtain a plurality of successful access records; calculating the intersection of the field types of the historical access requests in all the successful access records to obtain at least one universal field; determining other fields in the access request except the universal field as a to-be-predicted field; inputting the to-be-predicted field into a trained risk field identification neural network to obtain the field of focus in the access request; analyzing the field risk corresponding to the field of focus according to a plurality of historical access records related to the target database; determining an access strategy of the target user when accessing the target database according to the field risk. 2.The AI security monitoring method based on database access analysis according to claim 1, wherein, The risk field identification neural network is a CNN network architecture, which is trained by a training data set comprising a plurality of training field data and corresponding risk attention degree labels. 3.The AI security monitoring method based on database access analysis according to claim 1, wherein, The analysis of the field risk corresponding to the field of focus according to a plurality of historical access records related to the target database comprises: determining a plurality of similar databases similar to the target database in a preset database set; traversing the historical access records of all the similar databases to obtain a plurality of dangerous access records; for each field of focus, calculating the similarity between each request field of each dangerous access request in each dangerous access record and the field of focus; screening the request fields with a similarity greater than a preset first similarity threshold to obtain a dangerous field; determining the average value of the similarity of all the dangerous fields as the field risk corresponding to the field of focus.

4. The AI security monitoring method based on database access analysis according to claim 3, characterized in that, The parameter similarity between the database parameters of the similar databases and the database parameters of the target database is greater than a preset second similarity threshold; the database parameters include at least one of database storage location, database size, database data type, database architecture and database language type. 5.The AI security monitoring method based on database access analysis according to claim 1, wherein, The access strategy includes access parameters and access permissions; the access parameters include access encryption level, access container and access transfer parameters.

6. The AI security monitoring method based on database access analysis according to claim 5, characterized in that, The determination of the access strategy of the target user when accessing the target database according to the field risk comprises: calculating the average value of the field risk of all the fields of focus to obtain an access risk value; judging whether the access risk value is greater than a preset first risk value threshold to obtain a first judgment result; if the first judgment result is yes, determining that the access permission is not allowed to access; if the first judgment result is no, determining that the access permission is allowed to access, and judging whether the access risk value is less than a preset second risk value threshold to obtain a second judgment result; the second risk value threshold is less than the first risk value threshold. If the second determination result is yes, it is determined that the access parameter is an access parameter for directly accessing the target database. If the second determination result is no, according to the access risk value, the access parameter corresponding to the security level is determined in a preset risk value and parameter corresponding relationship.

7. An AI security monitoring system based on database access analysis, characterized by, The system comprises: An acquisition module configured to acquire an access request of a target user to a target database; A prediction module configured to predict a field of interest in the access request based on a neural network model, comprising: Acquiring a plurality of historical access records of the target user; Filtering the historical access records that successfully access the database to obtain a plurality of successful access records; Calculating the intersection of the field types of the historical access requests in all the successful access records to obtain at least one universal field; Determining other fields in the access request except the universal field as a to-be-predicted field; Inputting the to-be-predicted field into a trained risk field identification neural network to obtain the field of interest in the access request; An analysis module configured to analyze a field risk corresponding to the field of interest according to a plurality of historical access records related to the target database; A determination module configured to determine an access strategy of the target user when accessing the target database according to the field risk.

8. An AI security monitoring system based on database access analysis, characterized by, The system comprises: A memory storing executable program codes; A processor coupled with the memory; The processor invokes the executable program codes stored in the memory to execute the AI security monitoring method based on database access analysis according to any one of claims 1-6.

Images