Database traffic auditing method, device and equipment and storage medium

Abstract

The invention discloses a database traffic auditing method, device and equipment and a storage medium, and relates to the field of databases, and the method comprises the following steps: deploying a target extension program in a kernel layer of an operating system, and capturing a target data packet by using a target probe in the target extension program; performing protocol analysis on the target data packet to extract target data, determining execution time of a target SQL statement based on the target data, and performing semantic analysis on the target SQL statement by using a target analyzer and a way of performing analysis based on syntax imported based on a bypass to obtain a corresponding semantic analysis result; the target data comprises a target SQL statement and target metadata; and storing the target data, the execution time and the semantic analysis result to a target log database, so as to audit the flow of the target database based on the data in the target log database by using a pre-configured target audit strategy. According to the method and the device, efficient, safe and real-time auditing of database traffic is realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of databases, and in particular to a database traffic auditing method, device, equipment and storage medium. BACKGROUND

[0002] Currently, when auditing the traffic of a database, a method of embedding an auditing mechanism in a kernel is usually adopted, and the auditing function is realized through the mechanism of the database itself. This results in that the database itself auditing function needs to record operation logs in the database, thereby increasing the I / O (Input / Output) and CPU load of the system, and especially in a high concurrency scenario, the database performance will be significantly affected. At the same time, the middleware auditing or log analysis needs to modify the application program or the database configuration, which is complex to deploy and may introduce stability risks. In addition, the traditional method relies on log batch processing, and cannot monitor the SQL operation in real time, so it is difficult to respond to security events in a timely manner.

[0003] In summary, how to realize efficient, safe and real-time auditing of the traffic of a database is a problem to be solved at present. SUMMARY

[0004] Therefore, the purpose of the present application is to provide a database traffic auditing method, device, equipment and storage medium, which can realize efficient, safe and real-time auditing of the traffic of a database. The specific scheme is as follows:

[0005] In a first aspect, the present application discloses a database traffic auditing method, comprising:

[0006] deploying a target extension program in a kernel layer of an operating system to capture target data packets of a target database by using a target probe in the target extension program; the target extension program is an extended Berkeley packet filter program; the target probe includes a first target probe and a second target probe; the first target probe is used to obtain data in a kernel state of the operating system, and the second target probe is used to obtain data in a kernel state of the target database;

[0007] performing protocol analysis on the target data packets to extract target data, determining the execution time of a target SQL statement based on the target data, and performing semantic analysis on the target SQL statement by using a target parser and a syntax based on bypass import to obtain a corresponding semantic analysis result; the target data includes the target SQL statement and target metadata;

[0008] storing the target data, the execution time and the semantic analysis result to a target log database, and auditing the traffic of the target database based on the data in the target log database by using a pre-configured target auditing strategy.

[0009] Optionally, the capturing the target data packet of the target database by the target probe in the target extension program comprises:

[0010] determining, by the first target probe of the target extension program, a client IP address of a target TCP connection and a target process number of a target byte stream of the target database, to determine a target process corresponding to the target process number and a database type of the target database;

[0011] capturing the target data packet of the target database by the second target probe corresponding to the database type.

[0012] Optionally, the capturing the target data packet of the target database by the second target probe corresponding to the database type comprises:

[0013] if the database type of the target database is a MySQL database, adding a first target function probe to obtain the target data packet of the target database;

[0014] if the database type of the target database is a PostgreSQL database, adding a second target function probe to obtain the target data packet of the target database;

[0015] The second target probe comprises the first target function probe and the second target function probe, the first target function probe is a probe for detecting a dispatch_command function, and the second target function probe is a probe for detecting an exec_simple_query function.

[0016] Optionally, before the performing semantic analysis on the target SQL statement by the target parser and the syntax based on the bypass import to obtain a corresponding semantic analysis result, the method further comprises:

[0017] determining, based on the database type of the target database, a target lexical rule and a target syntax rule by a target syntax file, to construct a target parser based on the target syntax rule and the target lexical rule.

[0018] Optionally, the performing semantic analysis on the target SQL statement by the target parser and the syntax based on the bypass import to obtain a corresponding semantic analysis result comprises:

[0019] performing semantic analysis on the target SQL statement by the target parser and the syntax based on the bypass import to obtain a corresponding semantic analysis result.

[0020] The target syntax tree is traversed to obtain a semantic analysis result corresponding to the target SQL statement.

[0021] Optionally, the traversing of the target syntax tree to obtain the semantic analysis result corresponding to the target SQL statement comprises:

[0022] The target syntax tree is traversed to obtain an injection feature value detection result corresponding to the target SQL statement.

[0023] The target syntax tree is traversed to obtain an attack feature recognition result corresponding to the target SQL statement.

[0024] The semantic analysis result corresponding to the target SQL statement is determined based on the injection feature value detection result and the attack feature recognition result.

[0025] The injection feature value detection result comprises a tautology condition detection result, a multi-statement execution detection result, a UNION injection detection result, a comment bypass detection result, a keyword detection result and a dynamically spliced string detection result; and the attack feature recognition result comprises an unauthorized access recognition result, an unauthorized operation recognition result, a privilege escalation recognition result and a bypass recognition result.

[0026] Optionally, the target audit policy comprises sensitive operation alarm and traffic threshold alarm; and a policy rule of the target audit policy comprises a network layer rule, a protocol layer rule and an application layer protocol.

[0027] In a second aspect, the present application discloses a database traffic audit device, comprising:

[0028] A data packet capturing module is configured to deploy a target extension program in a kernel layer of an operating system to capture target data packets of a target database by using a target probe in the target extension program; the target extension program is an extended Berkeley packet filter program; the target probe comprises a first target probe and a second target probe; the first target probe is configured to obtain data in a kernel state of the operating system, and the second target probe is configured to obtain data in a kernel state of the target database.

[0029] A data analysis module is configured to perform protocol analysis on the target data packets to extract target data, determine an execution time of a target SQL statement based on the target data, and perform semantic analysis on the target SQL statement by using a target parser and a bypass import-based syntax to obtain a corresponding semantic analysis result; the target data comprises the target SQL statement and target metadata.

[0030] A traffic auditing module is configured to store the target data, the execution time and the semantic analysis result into a target log database, and to audit the traffic of the target database based on data in the target log database by using a pre-configured target auditing strategy.

[0031] In a third aspect, the present application discloses an electronic device, comprising:

[0032] A memory configured to store a computer program;

[0033] A processor configured to execute the computer program to implement the database traffic auditing method.

[0034] In a fourth aspect, the present application discloses a computer readable storage medium configured to store a computer program, wherein the computer program is executed by a processor to implement the database traffic auditing method.

[0035] In the present application, when performing database traffic auditing, a target extension program is deployed at a kernel layer of an operating system to capture target data packets of a target database by using a target probe in the target extension program; the target extension program is an extended Berkeley Packet Filter program; the target probe includes a first target probe and a second target probe; the first target probe is configured to acquire data in a kernel state of the operating system, and the second target probe is configured to acquire data in a kernel state of the target database; the target data packets are subjected to protocol analysis to extract target data, the execution time of a target SQL statement is determined based on the target data, and the target SQL statement is subjected to semantic analysis by using a target parser and a bypass imported grammar to obtain a corresponding semantic analysis result; the target data includes the target SQL statement and target metadata; the target data, the execution time and the semantic analysis result are stored into a target log database, and the traffic of the target database is audited based on data in the target log database by using a pre-configured target auditing strategy. It can be seen that, by using the eBPF technology to deploy the target extension program at the kernel layer of the operating system to capture the target data packets, the kernel state zero-copy processing is realized, the real-time performance of the database traffic auditing is ensured, and the traffic auditing efficiency is greatly improved; moreover, the database configuration or application code does not need to be modified, and the zero-invasive deployment is realized. Meanwhile, the bypass imported grammar analysis mode supports hot deployment of a new target parser, and the accurate identification of attack behaviors can be realized by analyzing the target SQL statement. In addition, the target log database provides traceable auditing logs, meets the compliance requirements of, for example, the Cybersecurity Protection, the GDPR, etc., and ensures the data integrity. BRIEF DESCRIPTION OF DRAWINGS

[0036] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0037] Figure 1 This application discloses a flowchart of a database traffic auditing method.

[0038] Figure 2 This is a schematic diagram of a specific database traffic auditing architecture hierarchy disclosed in this application;

[0039] Figure 3 This is a schematic diagram of the structure of a database traffic auditing device disclosed in this application;

[0040] Figure 4 This is a structural diagram of an electronic device disclosed in this application. Detailed Implementation

[0041] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0042] Currently, database traffic auditing typically involves embedding the auditing mechanism into the kernel, relying on the database's own mechanisms to implement the auditing function. This necessitates the database's own auditing function recording operation logs internally, increasing system I / O (Input / Output) and CPU load, significantly impacting database performance, especially in high-concurrency scenarios. Furthermore, middleware auditing or log analysis requires modifications to application or database configurations, resulting in complex deployments and potential stability risks. Additionally, traditional methods rely on batch log processing, failing to monitor SQL operations in real time and hindering timely responses to security incidents. To address these technical issues, this application discloses a database traffic auditing method capable of achieving efficient, secure, and real-time auditing of database traffic.

[0043] See Figure 1 As shown in the figure, an embodiment of the present invention discloses a database traffic auditing method, including:

[0044] Step S11: Deploy a target extension program in the kernel layer of the operating system to capture target data packets of the target database using the target probe in the target extension program; the target extension program is an extended Berkeley packet filter program; the target probe includes a first target probe and a second target probe; the first target probe is used to obtain kernel-mode data of the operating system, and the second target probe is used to obtain kernel-mode data of the target database.

[0045] In this embodiment, as Figure 2 As shown, a target extension program is deployed at the kernel layer of the operating system. The target probes within the extension program capture target data packets such as database traffic and kernel events. The target probes include a kprobe probe (the operating system kernel-level probe, i.e., the first target probe) and an uprobe probe (the database kernel-level probe, i.e., the second target probe). The target extension program is an extended Berkeley packet filter program. The first target probe is used to obtain kernel-level data from the operating system, and the second target probe is used to obtain kernel-level data from the target database. In other words, an eBPF (Extended Berkeley Packet Filter) program can be written using the BCC (BPF Compiler Collection) tool to collect data through kernel probes (kprobe) and user probes (uprobe). These two probes can obtain network byte stream data from the database client to the server, as well as the source and destination of this network byte stream. The instrumentation process consists of three steps: network stream source parsing, database SQL parsing, and result statistics. This means that this embodiment does not require modification of the database configuration or application code, achieving zero-intrusion deployment. In one specific implementation, this embodiment utilizes eBPF technology to achieve kernel-mode zero-copy processing, which improves throughput by 200% and reduces CPU utilization by 70% compared to traditional methods, resulting in a significant performance leap.

[0046] In this embodiment, capturing target data packets of the target database using the target probe in the target extension program includes: using the first target probe of the target extension program to determine the client IP address of the target database corresponding to the target TCP (Transmission Control Protocol) connection and the target process ID of the target byte stream, so as to determine the target process corresponding to the target process ID and the database type of the target database; and using the second target probe corresponding to the database type to capture the target data packets of the target database. Accordingly, capturing the target data packets of the target database using the second target probe corresponding to the database type includes: if the database type of the target database is a MySQL database, then adding a first target function probe to obtain the target data packets of the target database; if the database type of the target database is a PostgreSQL database, then adding a second target function probe to obtain the target data packets of the target database; wherein, the second target probe includes a first target function probe and a second target function probe, the first target function probe being a probe for detecting the dispatch_command function, and the second target function probe being a probe for detecting the exec_simple_query function.

[0047] In this embodiment, as Figure 2 As shown, during the network flow source resolution phase, the kprobe kernel probe is used to obtain data from the operating system kernel. A probe is added to the kernel function `inet_csk_accept`, which handles TCP connections. The `sockaddr` structure data within the function is parsed to obtain the client's IP address at the time of TCP connection establishment. The `inet_csk_accept` function probe also retrieves data from the `conn_event` structure. The `pid` field in this structure indicates the process ID of the process to which the current byte stream is to be sent. Using the process ID, the process name corresponding to that process is obtained using the operating system's `ps` command. This determines which database type (MySQL or PostgreSQL) user function probe to use to obtain the SQL statement to be sent to the database server, preparing for subsequent SQL statement parsing. The database type obtained through network stream parsing determines the uprobe function to use to capture the SQL statements transmitted by the database. If the database type is MySQL, the SQL statements transmitted by MySQL are captured by adding a probe of the dispatch_command function (i.e., the first target function probe). If the database type is PostgreSQL, the SQL statements transmitted by PostgreSQL are captured by adding a probe of the exec_simple_query function (i.e., the second target function probe), thereby completing the capture of the target data packet.

[0048] Step S12: Perform protocol parsing on the target data packet to extract target data, determine the execution time of the target SQL statement based on the target data, and perform semantic analysis on the target SQL statement using a target parser and a parsing method based on bypass import syntax to obtain the corresponding semantic analysis results; the target data includes the target SQL statement and target metadata.

[0049] In this embodiment, the captured data packets are parsed to extract the SQL statements and related target metadata, such as the client's IP address, the execution time of each SQL statement, and the return result of each SQL statement. During the database SQL parsing phase, the execution time of the current SQL statement can also be obtained by processing the probe functions of MySQL and PostgreSQL. For MySQL, the time of the entry function `dispatch_command` is recorded, which is when the SQL statement just begins entering the MySQL database, and the time of the exit function `mysql_execute_command` is recorded, which is when the SQL statement just ends. The difference between these two times is the total execution time of the SQL statement in the MySQL database. For PostgreSQL, both the entry and exit points of SQL execution are within the `exec_simple_query` function, so the start and end times of this function need to be calculated, and the difference between these two times is the execution time of the SQL statement in the PostgreSQL database. Through the above data statistics, the original SQL statement and its execution time on the database server can be obtained. Figure 2 As shown, after the database server completes its execution, it returns the execution result to the client. At this point, the data returned to the client can be obtained through the `send()` function, which is accessed via a kernel-level probe. By analyzing the SQL parsing and the statistics of the returned results, the overall network traffic over a certain period can be determined. In one specific implementation, using one second as the smallest recording unit allows for recording the traffic volume per unit time, facilitating subsequent control of traffic input and output.

[0050] In this embodiment, before performing semantic analysis on the target SQL statement using the target parser and a parsing method based on bypass imports to obtain the corresponding semantic analysis results, the method further includes: determining target lexical rules and target syntax rules based on the database type of the target database using a target syntax file, and constructing a target parser based on the target syntax rules and target lexical rules to achieve hot deployment of the protocol parser. Correspondingly, performing semantic analysis on the target SQL statement using the target parser and a parsing method based on bypass imports to obtain the corresponding semantic analysis results includes: using the parsing method based on bypass imports, passing the target SQL statement to the parser code of the target parser to obtain the target syntax tree corresponding to the target SQL statement; and traversing the target syntax tree to obtain the semantic analysis results corresponding to the target SQL statement.

[0051] In one specific implementation, the SQL statements generated during the eBPF probe and data parsing phase are logged. This allows for the bypass recording of database SQL without impacting database performance. Database administrators can then analyze the target SQL statements without logging into the database. However, since the recorded target SQL statements are only the raw SQL, simply recording what SQL the client sends to the server, ANLTR (Another Tool for Language Recognition) can be used to parse and analyze the raw target SQL statements. First, using the SQL syntax file provided by the ANTLR community, the target database type (MySQL or PostgreSQL) is selected based on the eBPF parsing results. The lexical and parser rules of the SQL are defined using the target syntax file, and then parser code is generated. The SQL statement is passed to the parser code generated by the ANLTR parser to parse the SQL file, converting the input SQL string into a syntax tree. Then, the semantic analysis results corresponding to the target SQL statement can be obtained by traversing the syntax tree using a listener or visitor pattern.

[0052] In this embodiment, traversing the target syntax tree to obtain the semantic analysis results corresponding to the target SQL statement includes: traversing the target syntax tree to obtain the injection feature value detection results corresponding to the target SQL statement; traversing the target syntax tree to obtain the attack feature identification results corresponding to the target SQL statement; and determining the semantic analysis results corresponding to the target SQL statement based on the injection feature value detection results and the attack feature identification results. The injection feature value detection results include true condition detection results, multi-statement execution detection results, UNION injection detection results, comment bypass detection results, keyword detection results, and dynamic string concatenation detection results. The attack feature identification results include unauthorized access identification results, unauthorized operation identification results, privilege escalation identification results, and privilege bypass identification results.

[0053] In one specific implementation, the syntax tree can be used to detect SQL injection vulnerabilities by analyzing their signatures. This allows for the identification of SQL injection risks, including the following:

[0054] 1. Tautology condition: The OR condition is followed by a tautology expression, such as 1=1, 'a'='a', etc.

[0055] 2. Multi-statement execution: Detects additional statements after a semicolon ";". For example, "SELECT * FROM users; DROPTABLE users".

[0056] 3. UNION Injection: Detects unexpected UNION operations.

[0057] 4. Comment bypass: Detects conditional truncation after "--" or " / * * / ".

[0058] 5. Sensitive functions / keywords: Detect dangerous operations such as LOAD_FILE, EXEC, INTO OUTFILE, etc.

[0059] 6. Dynamically concatenated strings: such as "+ userInput +".

[0060] Secondly, it can identify the characteristics of privilege escalation attack SQL, such as the following types of privilege escalation attack SQL:

[0061] 1. Accessing unauthorized tables or columns: When a user executes "SELECT * FROM admin_users", the user does not have permission to access the admin_users table and reads sensitive columns in the user_info table that the user does not have permission to access, such as password and SSN.

[0062] 2. Operations exceeding authorized data range: Lack of user context filtering, such as a regular user executing "SELECT * FROM orders" instead of "SELECT * FROM orders WHERE user_id=123".

[0063] 3. Performing privilege escalation operations: Ordinary users execute high-risk statements such as "GRANT / REVOKE / ALTER USER / CREATE TABLE".

[0064] 4. Exploit vulnerabilities to bypass permission checks: Modify filter conditions via SQL injection (e.g., change "WHERE user_id=123AND 1=1" to "WHERE 1=1" to obtain all user data).

[0065] Through the above syntax analysis, harmful SQL statements can be identified by parsing the syntax imported via a bypass. These statements can then be logged and processed using a specified strategy.

[0066] Step S13: Store the target data, the execution time, and the semantic analysis results in the target log database to audit the traffic of the target database based on the data in the target log database using a pre-configured target audit strategy.

[0067] In this embodiment, the target data, execution time, and semantic analysis results are all stored in the target log database. In one specific implementation, the raw SQL statements obtained from the eBPF probe and data parsing, along with the syntax tree obtained from syntax analysis, are recorded in files. Simultaneously, these files are transmitted to the Elasticsearch system via Kafka synchronization, facilitating storage in the target log database and subsequent querying. Traceable audit logs meet compliance requirements such as the Information Security Level Protection System (ISLP) and GDPR (General Data Protection Regulation), and a log tampering detection mechanism can also be introduced to ensure data integrity.

[0068] In this embodiment, the pre-configured target auditing policies include sensitive operation alarms and traffic threshold alarms; the policy rules of the target auditing policies include network layer rules, protocol layer rules, and application layer protocols. These target auditing policies allow for auditing of traffic to the target database based on data in the target log database. In one specific implementation, network layer rules refer to obtaining the source IP of network traffic through the syntax parsing process. Based on these source IPs, IP blacklists and whitelists are set, thereby controlling which clients can access the data and which are prohibited from accessing it in a bypass manner. Network traffic obtained through SQL parsing can also be controlled at the network layer rules to reduce database pressure and prevent abnormal database states. Protocol layer rules are used to determine whether a TCP connection is encrypted and to set warnings for unencrypted connections. Application layer protocols take effect during the syntax parsing stage to determine whether the SQL is an injection attack SQL or provides privilege escalation attack SQL. If the determination result shows that the SQL is an attack SQL, the connection can be disconnected by controlling the kernel-mode probe, thereby better protecting database security. By controlling different dimensions at various levels, the system achieves end-to-end monitoring from network connection to SQL operation, accurately identifying attack behaviors such as SQL injection attacks and SQL privilege escalation attacks, thereby better protecting database security.

[0069] As can be seen, this application achieves kernel-level zero-copy processing by deploying target extensions at the operating system kernel layer using eBPF technology to capture target data packets. This significantly improves traffic auditing efficiency while ensuring real-time database traffic auditing, and it achieves zero-intrusion deployment without modifying database configuration or application code. Furthermore, the parsing method based on bypass import syntax supports hot deployment of new target parsers, and accurate identification of attack behaviors can be achieved by analyzing target SQL statements. In addition, the target log database provides traceable audit logs, meeting compliance requirements such as information security level protection and GDPR, ensuring data integrity.

[0070] See Figure 3 As shown, this application discloses a database traffic auditing device, comprising:

[0071] The packet capture module 11 is used to deploy a target extension program at the kernel layer of the operating system to capture target packets of the target database using the target probe in the target extension program; the target extension program is an extended Berkeley packet filter program; the target probe includes a first target probe and a second target probe; the first target probe is used to obtain kernel-mode data of the operating system, and the second target probe is used to obtain kernel-mode data of the target database;

[0072] The data parsing module 12 is used to perform protocol parsing on the target data packet to extract target data, determine the execution time of the target SQL statement based on the target data, and perform semantic analysis on the target SQL statement using a target parser and a parsing method based on bypass import syntax to obtain the corresponding semantic analysis results; the target data includes the target SQL statement and target metadata;

[0073] The traffic audit module 13 is used to store the target data, the execution time, and the semantic analysis results into the target log database, so as to audit the traffic of the target database based on the data in the target log database using a pre-configured target audit strategy.

[0074] As can be seen, this application achieves kernel-level zero-copy processing by deploying target extensions at the operating system kernel layer using eBPF technology to capture target data packets. This significantly improves traffic auditing efficiency while ensuring real-time database traffic auditing, and it achieves zero-intrusion deployment without modifying database configuration or application code. Furthermore, the parsing method based on bypass import syntax supports hot deployment of new target parsers, and accurate identification of attack behaviors can be achieved by analyzing target SQL statements. In addition, the target log database provides traceable audit logs, meeting compliance requirements such as information security level protection and GDPR, ensuring data integrity.

[0075] In one specific embodiment, the data packet capture module 11 may include:

[0076] The information determination submodule is used to determine the client IP address of the target database corresponding to the target TCP connection and the target process number of the target byte stream using the first target probe of the target extension program, so as to determine the target process corresponding to the target process number and the database type of the target database;

[0077] The packet capture submodule is used to capture target packets of the target database using the second target probe corresponding to the database type.

[0078] In one specific implementation, the packet capture submodule may include:

[0079] The first data packet capture unit is used to add a first target function probe to obtain the target data packet of the target database if the database type of the target database is a MySQL database;

[0080] The second data packet capture unit is used to add a second target function probe to obtain the target data packets of the target database if the database type of the target database is a PostgreSQL database;

[0081] The second target probe includes the first target function probe and the second target function probe. The first target function probe is used to probe the dispatch_command function, and the second target function probe is used to probe the exec_simple_query function.

[0082] In one specific embodiment, the device may further include:

[0083] The parser construction module is used to determine target lexical rules and target grammar rules based on the database type of the target database using the target grammar file, and to construct a target parser based on the target grammar rules and target lexical rules.

[0084] In one specific embodiment, the data parsing module 12 may include:

[0085] The syntax tree acquisition submodule is used to parse the syntax tree based on the bypass import method. It passes the target SQL statement to the parser code of the target parser to obtain the target syntax tree corresponding to the target SQL statement.

[0086] The semantic analysis submodule is used to traverse the target syntax tree to obtain the semantic analysis results corresponding to the target SQL statement.

[0087] In one specific implementation, the semantic analysis submodule may include:

[0088] An injection feature detection unit is used to traverse the target syntax tree to obtain the injection feature detection result corresponding to the target SQL statement;

[0089] An attack feature identification unit is used to traverse the target syntax tree to obtain the attack feature identification result corresponding to the target SQL statement;

[0090] The semantic analysis unit is used to determine the semantic analysis result corresponding to the target SQL statement based on the injection feature value detection result and the attack feature identification result;

[0091] The injection feature detection results include tautology condition detection results, multi-statement execution detection results, UNION injection detection results, comment bypass detection results, keyword detection results, and dynamic string concatenation detection results; the attack feature identification results include unauthorized access identification results, unauthorized operation identification results, privilege escalation identification results, and privilege bypass identification results.

[0092] Furthermore, embodiments of this application also disclose an electronic device, Figure 4This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application.

[0093] Figure 4 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of this application. Specifically, the electronic device 20 may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the database traffic auditing method disclosed in any of the foregoing embodiments. Alternatively, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0094] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0095] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk, or optical disk, etc. The resources stored thereon can include an operating system 221, computer programs 222, etc., and the storage method can be temporary storage or permanent storage.

[0096] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of performing the database traffic auditing method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include computer programs capable of performing other specific tasks.

[0097] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned disclosed database traffic auditing method. Specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0098] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0099] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0100] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0101] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0102] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A database traffic auditing method, characterized in that, include: Deploy a target extension at the kernel level of the operating system to capture target data packets from the target database using the target probes in the target extension; The target extension program is an extended Berkeley packet filter program; the target probe includes a first target probe and a second target probe; The first target probe is used to obtain kernel-mode data of the operating system, and the second target probe is used to obtain kernel-mode data of the target database; The target data packet is parsed to extract target data. Based on the target data, the execution time of the target SQL statement is determined. The target SQL statement is then semantically analyzed using a target parser and a parsing method based on bypass import syntax to obtain the corresponding semantic analysis results. The target data includes the target SQL statement and target metadata. The target data, the execution time, and the semantic analysis results are stored in the target log database to audit the traffic of the target database based on the data in the target log database using a pre-configured target audit strategy.

2. The database traffic auditing method according to claim 1, characterized in that, The method of capturing target data packets from the target database using the target probe in the target extension includes: The first target probe of the target extension program is used to determine the client IP address of the target database corresponding to the target TCP connection and the target process number of the target byte stream, so as to determine the target process corresponding to the target process number and the database type of the target database; The target data packets of the target database are captured using the second target probe corresponding to the database type.

3. The database traffic auditing method according to claim 2, characterized in that, The step of capturing the target data packet of the target database using the second target probe corresponding to the database type includes: If the target database is a MySQL database, then a first target function probe is added to obtain the target data packet of the target database; If the target database is a PostgreSQL database, then a second target function probe is added to obtain the target data packet of the target database; The second target probe includes the first target function probe and the second target function probe. The first target function probe is used to probe the dispatch_command function, and the second target function probe is used to probe the exec_simple_query function.

4. The database traffic auditing method according to claim 1, characterized in that, Before performing semantic analysis on the target SQL statement using a target parser and a parsing method based on bypass imports to obtain the corresponding semantic analysis results, the method further includes: Based on the database type of the target database, target lexical rules and target grammar rules are determined using the target grammar file, and a target parser is constructed based on the target grammar rules and target lexical rules.

5. The database traffic auditing method according to claim 4, characterized in that, The method of performing semantic analysis on the target SQL statement using a target parser and a syntax based on bypass imports to obtain the corresponding semantic analysis results includes: The parsing method based on bypass import syntax passes the target SQL statement to the parser code of the target parser to obtain the target syntax tree corresponding to the target SQL statement; The target syntax tree is traversed to obtain the semantic analysis results corresponding to the target SQL statement.

6. The database traffic auditing method according to claim 5, characterized in that, The step of traversing the target syntax tree to obtain the semantic analysis result corresponding to the target SQL statement includes: The target syntax tree is traversed to obtain the injection feature value detection results corresponding to the target SQL statement; The target syntax tree is traversed to obtain the attack feature identification results corresponding to the target SQL statement; Based on the injection feature value detection results and the attack feature identification results, the semantic analysis results corresponding to the target SQL statement are determined; The injection feature detection results include tautology condition detection results, multi-statement execution detection results, UNION injection detection results, comment bypass detection results, keyword detection results, and dynamic string concatenation detection results; the attack feature identification results include unauthorized access identification results, unauthorized operation identification results, privilege escalation identification results, and privilege bypass identification results.

7. The database traffic auditing method according to any one of claims 1 to 6, characterized in that, The target audit strategy includes sensitive operation alarms and traffic threshold alarms; the policy rules of the target audit strategy include network layer rules, protocol layer rules, and application layer protocols.

8. A database traffic auditing device, characterized in that, include: A packet capture module is used to deploy a target extension at the kernel layer of the operating system to capture target packets of the target database using the target probe in the target extension; The target extension program is an extended Berkeley packet filter program; the target probe includes a first target probe and a second target probe; The first target probe is used to obtain kernel-mode data of the operating system, and the second target probe is used to obtain kernel-mode data of the target database; The data parsing module is used to perform protocol parsing on the target data packet to extract target data, determine the execution time of the target SQL statement based on the target data, and perform semantic analysis on the target SQL statement using a target parser and a parsing method based on bypass import syntax to obtain the corresponding semantic analysis results; the target data includes the target SQL statement and target metadata; The traffic auditing module is used to store the target data, the execution time, and the semantic analysis results in the target log database, so as to audit the traffic of the target database based on the data in the target log database using a pre-configured target auditing strategy.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the database traffic auditing method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, Used to store a computer program, wherein the computer program, when executed by a processor, implements the database traffic auditing method as described in any one of claims 1 to 7.

Images