A database security situation awareness method and system based on multi-source data fusion

Abstract

This disclosure presents a database security situation awareness method and system based on multi-source data fusion, comprising: acquiring multi-source heterogeneous security data, generating security data in a unified format, identifying risk data, risk events, and risk explicitness levels based on a security rule base and a security event spatiotemporal correlation analysis algorithm; constructing a risk assessment model to obtain the security situation and risk implicitness levels based on risk data and risk events; establishing a time-series-based security risk prediction model to obtain predicted risk data, predicted risk events, and predicted risk levels; and optimizing the security event spatiotemporal correlation analysis algorithm, security rule base, risk assessment model, and security risk prediction model based on the predicted risk data, predicted risk events, actual risk data, and actual risk events. This method integrates multi-source heterogeneous security data, realizes security event correlation analysis, database security risk prediction, and situation awareness, thereby improving the level of database security protection.

Description

Technical Field

[0001] This invention relates to the field of database security, and in particular to a database security situation awareness method and system based on multi-source data fusion. Background Technology

[0002] With the deepening development of information technology, databases have become a core component of enterprise and organizational information systems, storing a large amount of important business data and sensitive information. Database security issues are becoming increasingly prominent, with various attack methods targeting databases constantly increasing, such as SQL injection, privilege abuse, and data theft, posing a severe challenge to data security.

[0003] Existing database security technologies primarily focus on single-point protection, such as database auditing systems, database status monitoring, database vulnerability scanning, static and dynamic data masking, and access control systems. These products generally operate independently, lacking information sharing and making it difficult to obtain a holistic view of the current security situation and form a unified security posture. These independent systems generate large amounts of security data, such as operation logs, status parameters, and vulnerability information, but this data is in various formats and stored in a scattered manner, making effective integration and analysis difficult. Faced with increasingly complex data security threats, there is a need to break down barriers, integrate information, and develop products that can deeply analyze and assess the overall risk posture of databases and predict future risks through data mining, correlation analysis, and machine learning technologies to improve overall data security.

[0004] Traditional database security detection methods often rely on fixed rule matching, lacking in-depth analysis of the temporal and spatial correlations between security events, making it difficult to detect complex attack behaviors and security risks. Furthermore, most existing security systems can only detect and respond to security events that have already occurred, lacking predictive risk assessment capabilities and failing to provide proactive warnings of potential security threats.

[0005] Therefore, there is an urgent need for a database security situation awareness method and system that can integrate multi-source heterogeneous security data, realize security event correlation analysis, and have risk prediction capabilities, so as to improve the level of database security protection. Summary of the Invention

[0006] In view of this, the present disclosure provides a database security situation awareness method and system based on multi-source data fusion, aiming to solve the technical problems in the prior art such as scattered database security data, lack of correlation analysis of security events, inaccurate risk assessment, and lack of predictability of security situation.

[0007] In a first aspect, embodiments of this disclosure provide a database security situation awareness method based on multi-source data fusion, employing the following technical solution:

[0008] Acquire multi-source heterogeneous security data; generate unified-format security data from the multi-source heterogeneous security data using preset data format standards and preset conversion rules; based on the unified-format security data, identify risk data and risk events through a security rule base and a security event spatiotemporal correlation analysis algorithm, and output the risk explicitness level; construct a machine learning-based risk assessment model, and obtain the security posture and risk implicitness level based on the risk data and the risk events, whereby the risk level includes the risk explicitness level and the risk implicitness level; establish a time-series-based security risk prediction model to obtain predicted risk data, predicted risk events, and predicted risk levels; acquire actual risk data and actual risk events, and optimize the security event spatiotemporal correlation analysis algorithm, the security rule base, the risk assessment model, and the security risk prediction model based on the predicted risk data, the predicted risk events, the actual risk data, and the actual risk events.

[0009] Preferably, the acquisition of multi-source heterogeneous security data includes: collecting operation logs from the database auditing system, operating parameters from the status monitoring system, security vulnerability information from the vulnerability scanning system, and sensitive data processing records from the de-identification system through standardized interfaces.

[0010] Preferably, the preset data format standard and preset conversion rules include one of the following rules: timestamp rules, data structure rules, or data type rules; wherein the timestamp rule is to identify the format type of the original timestamp in the multi-source heterogeneous security data, parse and extract time information and obtain the corresponding time zone information, and convert the original timestamp into UTC time format; the data structure rule is to parse the original data of different formats in the multi-source heterogeneous security data, extract key field information, and convert it into a standard data structure including event ID, device identifier, event type, severity level, and description information; the data type rule is to identify alarm messages, log messages, status messages, and event messages in the multi-source heterogeneous security data, and convert them into standard message classification and standard message tagging.

[0011] Preferably, the risk events include a first type of risk event and a second type of risk event, and the second type of risk event includes a combination of first risk events and a combination of second risk events. The step of identifying risk data and risk events based on the unified format security data, using a security rule base and a security event spatiotemporal correlation analysis algorithm, and outputting a risk visibility level includes: using the preset security rule base to perform rule matching on the unified format security data, marking the risk data and the first type of risk event; performing temporal and spatial correlation judgments on abnormal security events based on the security event spatiotemporal correlation analysis algorithm to obtain a first risk event combination that is correlated in time and a second risk event combination that is correlated in space; and outputting a risk event list and a risk visibility level based on the risk data, the first type of risk event, and the second type of risk event.

[0012] Preferably, the correlation determination in the time dimension includes: detecting whether there are multiple security events within the same preset time window, identifying abnormal events and abnormal time correlations, and obtaining a first risk event combination that is correlated in time.

[0013] Preferably, the spatial dimension correlation judgment includes: based on spatial elements, analyzing multiple security events from the same target object, identifying abnormal events and abnormal spatial correlations, and obtaining a second risk event combination that is spatially correlated; wherein, the spatial elements include at least one of IP address, user account, and database instance, and the target object is one of user object, database instance object, device object, and system object.

[0014] Preferably, the construction of the machine learning-based risk assessment model includes: extracting key features from historical risk data and historical risk events to form a feature vector, wherein the historical risk events include the first type of risk event, the first combination of risk events, and the second combination of risk events; establishing the risk assessment model based on the feature vector; inputting the currently detected risk data, the first type of risk event, the first combination of risk events, and the second combination of risk events into the risk assessment model, and outputting a risk latent level, wherein the risk level includes a risk explicit level and a risk latent level.

[0015] Preferably, establishing a time-series-based security risk prediction model includes: collecting historical risk data, establishing a time series, forming a time-series dataset, wherein the historical risk data includes risk data, risk events, and timestamps corresponding to the risk data and risk events, historical explicit risk level data, and historical implicit risk level data; based on the time-series dataset, analyzing the time variation patterns and trend characteristics of the risk level data, and establishing the security risk prediction model; based on the security risk prediction model, performing prediction calculations, and outputting the predicted risk data, the predicted risk events, and the predicted risk levels.

[0016] Preferably, the step of optimizing the spatiotemporal correlation analysis algorithm for security events, the security rule base, the risk assessment model, and the security risk prediction model based on the predicted risk data, the predicted risk events, the actual risk data, and the actual risk events includes: optimizing the spatiotemporal correlation analysis algorithm for security events, the security rule base, and the risk assessment model based on the actual risk data and the actual risk events, wherein the actual risk events include the first type of risk events, the combination of the first risk events, and the combination of the second risk events; comparing and analyzing the predicted risk data and the predicted risk events with the actual risk data and the actual risk events to calculate the prediction accuracy; and adjusting the security risk prediction model based on the prediction accuracy to obtain the optimized security risk prediction model.

[0017] Secondly, this disclosure also provides a database security situation awareness system based on multi-source data fusion, including:

[0018] The database security information acquisition module is used to acquire multi-source heterogeneous security data;

[0019] The data format conversion module is used to generate unified format security data from the multi-source heterogeneous security data based on preset data format standards and preset conversion rules.

[0020] The risk identification module is used to identify risk data and risk events based on the unified format security data, through a security rule base and a security event spatiotemporal correlation analysis algorithm, and output the risk visibility level.

[0021] The risk assessment module is used to obtain the security situation and risk level based on the risk data and risk events, wherein the risk level includes explicit risk level and implicit risk level;

[0022] The risk prediction module is used for time-series-based security risk prediction models to obtain predicted risk data, predicted risk events, and predicted risk levels.

[0023] The feedback optimization module is used to acquire actual risk data and risk events, and optimize the security event spatiotemporal correlation analysis algorithm, the security rule base and risk assessment model, and the security risk prediction model based on the predicted risk data, the predicted risk events, the actual risk data and risk events.

[0024] Thirdly, this disclosure also provides a computer device, which adopts the following technical solution:

[0025] The computer device includes:

[0026] At least one processor; and,

[0027] A memory communicatively connected to the at least one processor; wherein,

[0028] The memory stores instructions that can be executed by the at least one processor, which, when executed by the at least one processor, enables the at least one processor to perform any of the above-described database security situation awareness methods based on multi-source data fusion.

[0029] Fourthly, embodiments of this disclosure also provide a computer-readable storage medium storing computer instructions for causing a computer to execute any of the above-described database security situation awareness methods based on multi-source data fusion.

[0030] Fifthly, embodiments of this disclosure also provide a computer program product, including a computer program / instructions that, when executed by a processor, implement the steps of any of the methods described above.

[0031] The beneficial effects of the database security situation awareness method and system based on multi-source data fusion provided in this disclosure are as follows: Firstly, it achieves unified collection and standardized format processing of multi-source heterogeneous security data from databases, solving the problems of scattered security data and inconsistent formats; secondly, it innovatively proposes a spatiotemporal correlation analysis algorithm for security events, breaking through the limitations of traditional single-point security detection; thirdly, it constructs a quantitative assessment model of database security situation based on machine learning, achieving accurate risk level classification; fourthly, it establishes a security risk prediction model with forward-looking threat warning capabilities; and fifthly, it forms a closed-loop feedback optimization mechanism, continuously improving model accuracy through comparison of predictions and actual results, realizing real-time monitoring and dynamic risk assessment of multi-dimensional database security situation.

[0032] The above description is merely an overview of the technical solution disclosed herein. In order to better understand the technical means of this disclosure and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this disclosure more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0033] To more clearly illustrate the technical solutions of the embodiments of this disclosure, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0034] Figure 1 A flowchart of a database security situation awareness method based on multi-source data fusion provided in this embodiment of the disclosure;

[0035] Figure 2 This is a schematic diagram of the structure of a database security situation awareness system based on multi-source data fusion.

[0036] Figure 3 This is a schematic diagram of the structure of a computer device provided in an embodiment of the present disclosure. Detailed Implementation

[0037] The embodiments of this disclosure will now be described in detail with reference to the accompanying drawings.

[0038] It should be understood that the following specific examples illustrate the implementation of this disclosure, and those skilled in the art can easily understand other advantages and effects of this disclosure from the content disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of this disclosure, and not all of them. This disclosure can also be implemented or applied through other different specific implementation methods, and the details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of this disclosure. It should be noted that, in the absence of conflict, the following embodiments and features in the embodiments can be combined with each other. Based on the embodiments in this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0039] It should be noted that various aspects of embodiments within the scope of the appended claims are described below. It will be apparent that the aspects described herein can be embodied in a wide variety of forms, and any particular structure and / or function described herein is merely illustrative. Based on this disclosure, those skilled in the art will understand that one aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects set forth herein can be used to implement the device and / or practice the method. Additionally, this device and / or method can be implemented using structures and / or functionalities other than one or more of the aspects set forth herein.

[0040] It should also be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of this disclosure. The drawings only show the components related to this disclosure and are not drawn according to the number, shape and size of the components in actual implementation. In actual implementation, the form, quantity and proportion of each component can be arbitrarily changed, and the layout of the components may also be more complex.

[0041] Furthermore, specific details are provided in the following description to facilitate a thorough understanding of the examples. However, those skilled in the art will understand that the described aspects can be practiced without these specific details.

[0042] like Figure 1 As shown, this embodiment provides a database security situation awareness method based on multi-source data fusion, including the following steps:

[0043] Step S1: Obtain multi-source heterogeneous security data.

[0044] In this embodiment, the specific implementation of acquiring multi-source heterogeneous security data is as follows: Security data from different devices and systems is collected through standardized interfaces, including operation logs from the database auditing system, operating parameters from the status monitoring system, security vulnerability information from the vulnerability scanning system, and sensitive data processing records from the de-identification system, etc., generated by various independent systems. Specifically, the following three methods are used:

[0045] The first method involves data collection via the Syslog protocol. For database auditing and security monitoring devices that support the Syslog standard, a Syslog server is configured to receive security log information proactively pushed by each device, enabling real-time log data collection. Specifically, a multi-threaded (configurable) approach combined with a thread queue and a service listening port is used to receive and process messages sent by security devices. Upon receiving a message, it is verified. If the data is confirmed to be from the target device, it is discarded; otherwise, the message portion is processed according to parsing rules. If an error occurs during data parsing according to the rules, the data is discarded. Syslog messages received from the devices follow the Syslog protocol format, with the message body in JSON format. The preprocessing module receives the JSON message body and sends it to the corresponding Kafka topic.

[0046] The second approach is to collect data via Kafka broker message queues. For high-concurrency database status monitoring and vulnerability scanning systems, Kafka message queues are used for data buffering and batch collection, ensuring the stable transmission and processing of large amounts of security data.

[0047] The third method is data collection via the REST API interface. For security systems with web service interfaces, such as de-identification systems, security data is proactively obtained by periodically calling the REST API interface, supporting on-demand querying and incremental data synchronization.

[0048] Step S2: Using preset data format standards and preset conversion rules, generate unified format security data from the multi-source heterogeneous security data.

[0049] In this embodiment, the preset data format standard and preset conversion rules include one of the following rules: timestamp rules, data structure rules, or data type rules;

[0050] The timestamp rules involve identifying the format type of the original timestamps in multi-source heterogeneous security data, parsing and extracting the time information and obtaining the corresponding time zone information, and converting the original timestamps into UTC time format. The specific operations include: first, identifying the format type of the original timestamp (e.g., yyyy-MM-dd HH:mm:ss, Unix timestamp, ISO 8601 format, etc.); then, parsing and extracting the time information and obtaining the corresponding time zone information; next, converting the local time to UTC time; and finally, outputting it uniformly in the standard UTC time format (yyyy-MM-dd HH:mm:ss UTC). For data whose time zone cannot be identified, it is processed according to the system default time zone. For example, the database auditing system outputs "2024-01-15 14:30:25 +08:00" (Beijing time), the vulnerability scanning system outputs the Unix timestamp "1705298425", and the status monitoring system outputs the ISO format "2024-01-15T06:30:25Z". After unified conversion, they are all output in the standard format of "2024-01-15 06:30:25 UTC".

[0051] The data structure rules involve parsing raw data of different formats from multi-source heterogeneous security data, extracting key field information, and converting it into a standard data structure that includes event ID, device identifier, event type, severity level, and description information. Specifically, this includes uniformly converting structured data stored in relational databases, log files stored in file systems, and real-time data cached in memory into standardized JSON data objects, and parsing raw data in different formats such as XML, CSV, and binary, extracting key field information, and uniformly converting it into a standard JSON data structure.

[0052] The data type rules are designed to identify alarm messages, log messages, status messages, and event messages in multi-source heterogeneous security data, and convert them into standard message categories and standard message tags. Specifically, this includes reclassifying and tagging different types of security information such as alarm messages, log messages, status messages, and event messages according to a unified message classification standard; adding unified data header information to each piece of security data, including metadata information such as data source identifier, collection time, data version, and checksum; converting messages from different protocol formats into a unified message format; and performing necessary key acquisition and decryption processing.

[0053] Furthermore, in another embodiment, data encapsulation rules are also included, with each piece of secure data having a unified data header, including metadata information such as data source identifier, collection time, data version, and checksum, to ensure data integrity and traceability.

[0054] Furthermore, in another embodiment, it also includes data decryption rules, obtaining the decryption key for the corresponding device from the security key management system, and decrypting the encrypted audit logs and monitoring data; it supports multiple decryption algorithms, including AES-256, RSA-2048, etc.; it sets a key rotation mechanism to automatically update the communication key every 30 days; for sensitive operation logs, a double encryption mechanism is adopted, requiring administrator authorization to decrypt and view; at the same time, the data verification code is retained to ensure the integrity and consistency of the decrypted data.

[0055] Step S3: Based on the security data in the unified format, identify risk data and risk events based on the security rule base and the security event spatiotemporal correlation analysis algorithm, and output the risk visibility level.

[0056] In this embodiment, risk events include a first type of risk event and a second type of risk event, and the second type of risk event includes a combination of the first risk event and a combination of the second risk event.

[0057] In this embodiment, the process of identifying risk data and risk events based on unified format security data through rule matching and security event spatiotemporal correlation analysis algorithms includes:

[0058] First, using a pre-defined security rule base, security data in a uniform format is matched against rules to identify risky data and events. The security rule base includes rules identifying security threats such as SQL injection, abnormal privileges, sensitive data access, and unusual logins.

[0059] In this embodiment, the rule matching process includes: first, classifying security data according to event type; then, matching corresponding rule sets according to different types. For example, SQL injection detection rules match database operation statements containing keyword combinations such as union, select, and drop; permission anomaly detection rules match administrator privilege usage behavior during unauthorized time periods; sensitive data access detection rules match large-scale query operations containing sensitive fields such as ID card numbers and bank card numbers; and abnormal login detection rules match login behavior originating from abnormal geographical locations or outside of working hours. When data content or behavioral events successfully match threat feature patterns in the rule base, the system automatically adds risk labels to the data and behavioral events and records the specific rule type of the match. Data with risk labels is considered risky data, and behavioral events with risk labels are classified as first-type risk events. First-type risk events may be a single behavioral event or a combination of multiple behavioral events.

[0060] Secondly, based on the spatiotemporal correlation analysis algorithm for security events, the correlation of abnormal security events in the time dimension and the correlation in the spatial dimension are judged, resulting in a first risk event combination that is correlated in time and a second risk event combination that is correlated in space.

[0061] The correlation judgment in the time dimension includes: detecting whether there are multiple security events within the same preset time window, identifying abnormal events and abnormal time correlations, and obtaining the first risk event combination that is correlated in time.

[0062] In this embodiment, the correlation judgment in the time dimension includes: setting a time window (such as 5 minutes, 30 minutes, 2 hours), detecting whether there are multiple related security events within the same time window, such as multiple failed login attempts followed by successful login within a short period of time, continuous privilege escalation operations, etc., identifying abnormal events and abnormal time correlations, and obtaining the first risk event combination that is correlated in time.

[0063] In this embodiment, security events are first sorted by event timestamp. Then, a sliding time window mechanism is used to detect the event sequence one by one. When an event is detected, all related events within that time window are searched backward. The event time correlation judgment is based on predefined correlation rules, such as the combination of "login failure-login success" (successful login within 5 minutes after more than 3 login failures is considered suspicious), the combination of "permission query-permission escalation-sensitive operation" (occurring sequentially within 30 minutes and from the same user account), and the combination of "vulnerability scan-login attempt-data access" (continuous behavior against the same database instance within 2 hours).

[0064] When two or more related events are found within a time window, they are combined according to the chronological order of their occurrence and the strength of their association. The risk weight of the combined events is calculated (the sum of the weights of individual events multiplied by the time closeness coefficient). The shorter the time interval, the higher the coefficient. Finally, the related event record is output as "Event Combination ID + Combination Type + Risk Weight + Time Span".

[0065] Another example is when the system detects that a user account failed to log in five times consecutively at 2:30 AM, then successfully logged in at 2:45 AM and immediately performed database table structure modifications and a large number of data queries. The system will correlate these events within a 15-minute time window to identify possible brute-force account attacks and data theft. Yet another example is when an IP address performs a vulnerability scan on the database between 10:00 and 10:30 AM, attempts SQL injection at 11:00 AM, and successfully establishes a database connection and accesses sensitive tables at 11:20 AM. The system will identify this series of actions as an attack chain with a clear temporal correlation.

[0066] In addition, time-dimensional correlation analysis also includes periodic detection processing: establishing a periodic baseline model based on hours, days, and weeks, recording the frequency and pattern of events during normal business periods, using a moving average algorithm to calculate the event baseline value for each period, and marking an anomaly when the detected event combination exceeds 1.5 times the standard deviation of the historical baseline for that period, thus avoiding misjudging normal periodic business operations as risk event combinations; or marking an anomaly when the frequency of events detected in real time exceeds twice the baseline value for the corresponding period.

[0067] Simultaneously, by conducting year-on-year and month-on-month analyses at the hourly, daily, and weekly levels, periodic events can be identified. These periodic events can be given focused attention to prevent risk events from being dispersed and missed when embedded in normal operations. One possible implementation is to establish a three-tiered periodic baseline database to store the frequency and type distribution of normal events at the hourly, daily, and weekly levels. A periodic event whitelist mechanism should be set up to mark confirmed normal periodic business operations (such as scheduled backups and batch data processing) to avoid duplicate alerts. An event time heatmap should also be created to visually display the distribution density of risk events in different time periods, facilitating the identification of abnormal behavior patterns hidden within normal business operations.

[0068] Another optional implementation is to create an event time heatmap, using a 24-hour × 7-day grid matrix structure. The horizontal axis represents the 24 hours of a day, and the vertical axis represents the 7 days of a week. Each grid cell records the number of risk events that occurred within the corresponding time period. Color intensities are set according to event frequency: green for normal frequency, yellow for medium frequency, and red for high frequency. The system automatically updates the heatmap data every hour, identifying abnormal periods through color change trends. When the color of a certain period suddenly deepens or an abnormal red area appears, a key attention alert is automatically triggered. It also provides a time range filtering function, supporting viewing the heatmap distribution for the most recent 7 days, 30 days, or a custom time period, helping security administrators quickly locate the temporal patterns and abnormal patterns of risk events.

[0069] The spatial correlation determination includes analyzing multiple security events from the same target object based on spatial elements, identifying abnormal events and abnormal spatial correlations, and obtaining a second risk event combination with spatial correlation. The spatial elements include at least one of IP address, user account, and database instance, and the target object is one of user object, database instance object, device object, and system object. In this embodiment, based on spatial elements, security events of the target object are analyzed one by one to determine whether abnormal security events exist. A spatial correlation determination is then performed on the abnormal security events based on a security event spatiotemporal correlation analysis algorithm to identify the second risk event combination with spatial correlation.

[0070] In this embodiment, spatial dimension correlation analysis includes:

[0071] IP address association analysis: Establish an IP address event mapping table to record all security events of each IP address within a set time window. When the same IP address is detected to access 3 or more different database instances within 30 minutes, it is marked as suspicious scanning behavior. When the number of security events generated by the same IP address exceeds the normal threshold, it is automatically marked as an abnormal source, which is the second risk event combination.

[0072] User account behavior trajectory analysis: Track and record the operation sequence of each user account, including login time, accessed database objects, and types of operations performed, to establish a baseline of normal user behavior. When a user's operation pattern deviates from the historical baseline (such as a user who usually only queries specific tables suddenly accessing sensitive system tables), an abnormal operation trajectory alarm is triggered, which is the second risk event combination.

[0073] Database instance threat aggregation: Centered on a database instance, it counts all security events targeting that instance, including login attempts, permission operations, data access, etc. When a single database instance becomes the target of multiple types of security events in a short period of time, the instance is marked as a key protection target, which is the second risk event combination.

[0074] Cross-spatial element association detection: Comprehensive analysis of the association relationship between IP address, user account, and database instance to identify composite attack patterns, such as multiple user accounts from a specific IP simultaneously performing abnormal operations on the same database instance, outputting a spatial association risk event report, which is the second risk event combination.

[0075] Cross-device element correlation detection: This analyzes the correlation between events from different security devices. When a database auditing device detects abnormal SQL operations, a vulnerability scanning device discovers new vulnerabilities in the corresponding database, and a status monitoring device shows an increase in the number of abnormal connections to the database, these events from different devices but pointing to the same target are correlated. A rule base for inter-device event correlation is established, with a correlation time window set to 1 hour. When two or more different types of devices generate security events targeting the same database instance within the time window, cross-device correlation alarms are automatically generated, improving the detection capability of complex threats.

[0076] Finally, based on the risk data, the first type of risk events, and the second type of risk events, a list of risk events and the risk visibility level are output.

[0077] In this embodiment, the risk visibility level is calculated as follows: A base score is set for each risk data point; for example, SQL injection risk is 30 points, abnormal permission risk is 25 points, sensitive data access risk is 20 points, and abnormal login risk is 15 points. A base score is set for each security event; for example, the base score for a risk event is 40 points. Events with spatiotemporal correlation receive an additional score, for example, 30 points. Additional points are awarded based on the scope of the event's impact; for example, events involving multiple users receive 10 points, events involving administrator privileges receive 15 points, events affecting multiple database instances receive 20 points, and risks involving core business systems receive an additional 15 points. Risk levels are then divided according to the score range to obtain the risk visibility level; for example, scores above 90 are high-risk events, 60-89 are medium-risk events, and scores below 60 are low-risk events.

[0078] In another embodiment, a time urgency scoring rule can also be set: scores are awarded based on the time characteristics of the risk event, with 5 points awarded for risks occurring during working hours, 10 points for risks occurring outside working hours, and 15 points for risks occurring on holidays; risk events lasting more than 30 minutes are awarded 10 points, and those lasting more than 2 hours are awarded 20 points.

[0079] Spatiotemporal correlation determination method: The temporal correlation determination adopts a 15-minute sliding window. When two or more security events occur within the same time window, they are considered to be temporally correlated. The spatial correlation determination is based on three dimensions: events generated by the same IP address, operations performed by the same user account, and behaviors targeting the same database instance. Meeting any one of these dimensions is considered spatial correlation. Event combinations that meet both temporal and spatial correlation conditions are marked as having spatiotemporal correlation.

[0080] Related event aggregation processing: Aggregate related events within the same time window to generate event combination records. The risk level of the event combination is the highest risk level within the combination. When an event combination contains more than 3 medium-risk events, it is automatically upgraded to a high-risk combination.

[0081] Risk event list generation: All identified risk events are categorized and organized according to risk level, and a structured list containing information such as event ID, occurrence time, event type, risk type, risk level, rating details, involved parties, and number of related events is output.

[0082] Duplicate event deduplication: For the same risk events that occur repeatedly within a short period of time, they are merged to avoid duplicate alarms, while retaining the first discovery time and the cumulative number of occurrences.

[0083] Dynamic risk level adjustment: The risk visibility level is dynamically adjusted based on the duration and scope of the event. Medium-risk events lasting more than 1 hour are automatically upgraded to high-risk events, and the risk visibility level of events affecting multiple database instances is upgraded accordingly.

[0084] By using a scoring mechanism and dynamic adjustment of levels, the risk level is output as a visible level. The risk level is determined by intuitive data and events, which retains the intuitive value of the information and makes it easy for users to understand and trace.

[0085] Step S4: Construct a risk assessment model based on machine learning, and obtain the security situation and risk latency level based on the risk data and the risk events.

[0086] In this embodiment, the risk level includes a risk explicit level and a risk implicit level.

[0087] In this embodiment, the process of constructing a machine learning-based risk assessment model includes:

[0088] First, key features are extracted from historical risk data and historical risk events to form a feature vector. Historical risk events include the first type of risk event, the combination of the first risk event, and the combination of the second risk event.

[0089] In this embodiment, the feature extraction process includes:

[0090] 1) Basic feature extraction: Count the number of events that occur within 1 hour as frequency features, calculate the proportion of each type of event according to the four major types of SQL injection, permission abnormality, sensitive data access and abnormal login, record the number of database instances affected by the event, calculate the duration of the event from start to end in minutes, and count the number of different user accounts involved.

[0091] 2) Time feature extraction: Mark the specific time period when the event occurs (1 for working hours and 0 for non-working hours), identify whether it is a periodic event (marked as 1 if it occurs at the same time every day, otherwise 0), and calculate the time difference between the event occurrence time and the normal business peak period.

[0092] 3) Feature extraction: Record the number of related events that occurred within 30 minutes of the current event, identify the event combination type (1 for a single event and 2 for a combined event), and calculate the number of IP addresses involved and the distribution range of database instances.

[0093] 4) Feature standardization: All numerical features are normalized according to the 0-1 range to ensure that features of different magnitudes have the same weight, and finally form a feature vector containing 12 standardized feature values.

[0094] Then, a risk assessment model is established based on the feature vectors.

[0095] In this embodiment, model training and selection include:

[0096] 1) Collect historical security incident data from the past 6 months as training samples. Mark confirmed security incidents into three levels: high risk, medium risk, and low risk according to their actual impact. Establish a training dataset containing feature vectors and risk level labels to ensure that the number of samples for each risk level is basically balanced.

[0097] 2) Divide the historical security event data into a training set and a test set in an 8:2 ratio. The training set is used for model learning, and the test set is used to verify the model's performance.

[0098] 3) Configure the random forest model, set the number of decision trees to 100, and the maximum depth of each tree to 10 layers, to ensure that the model has sufficient learning ability while avoiding overfitting.

[0099] 4) The 5-fold cross-validation method is adopted. The training set is divided into 5 subsets. The model is trained by using 4 subsets in turn, and the effect is verified by using 1 subset. This is repeated 5 times and the average value is taken as the model performance index.

[0100] 5) Calculate the accuracy, recall, and F1 score of the model on the test set. When the accuracy reaches 85% or higher and the identification accuracy of each risk level exceeds 80%, the model is confirmed to meet the usability standard.

[0101] 6) Simultaneously train multiple random forest models with different configurations, compare the comprehensive performance indicators of each model, and select the model with the highest accuracy in identifying high-risk events as the final deployment model to ensure the ability to identify key security threats.

[0102] Finally, the currently detected risk data, the first type of risk event, the combination of the first risk event, and the combination of the second risk event are input into the risk assessment model, and the implicit risk level is output. In this embodiment, the implicit risk level is output as follows: the currently detected risk event is input into the trained model, and a risk score of 0-100 is output, along with the probability distribution of each risk level. For example, a score above 90 indicates a high-risk event, 60-89 indicates a medium-risk event, and a score below 60 indicates a low-risk event.

[0103] By extracting and analyzing features, the implicit risk level can be output, enabling in-depth analysis and utilization of data, which is conducive to uncovering the implicit value of data.

[0104] This embodiment employs a dual-phase mechanism of explicit and implicit risk levels, which is beneficial for multi-dimensional analysis of risk information.

[0105] The comprehensive assessment method for security posture is as follows: using days and weeks as time windows, statistical risk data, frequency and type of risk events are collected, the overall security posture index is calculated, and a weighted average method is used, with high-risk events having a weight of 3, medium-risk events having a weight of 2, and low-risk events having a weight of 1. The overall risk level and trend of the current database security posture are output.

[0106] It should be noted that when calculating the risk level of a risk event, the explicit risk level and the implicit risk level can be calculated separately to obtain the overall risk level and trend of the two database security postures. Alternatively, either the explicit risk level or the implicit risk level can be selected, or the higher of the two risk levels for the same event can be selected, or the weighted average of the two can be selected. There are no restrictions here.

[0107] This embodiment specifically includes: counting all risk events that occur within 24 hours on a daily basis, calculating the number of high, medium and low risk events respectively, and counting the total number of risk events and the proportion of each type of event on a weekly basis within 7 days; recording the distribution of event types, including the number of occurrences of four major types: SQL injection, abnormal permissions, sensitive data access and abnormal login.

[0108] For example, the formula "Situation Index = (Number of high-risk events × 3 + Number of medium-risk events × 2 + Number of low-risk events × 1) ÷ Total number of events × 100" is used to obtain a situation index value of 0-300 points; when the situation index is below 50 points, it is judged as a good security situation, 50-150 points is a general situation, and above 150 points is a high-risk situation.

[0109] Compare the difference between the current statistical period and the previous period's situation index. A positive difference indicates an upward trend in risk, while a negative difference indicates a downward trend in risk. A difference within ±10 points is considered a stable situation. Calculate the rate of change of the situation index over three consecutive statistical periods to identify the direction of continuous change in the risk situation.

[0110] Based on the current situation index and trend change direction, a comprehensive assessment result of "current risk level + trend change + key risk type" is output, providing an intuitive basis for situation judgment for safety management decisions.

[0111] Step S5: Establish a time-series-based security risk prediction model to obtain predicted risk data, predicted risk events, and predicted risk levels within a predetermined time period;

[0112] In this embodiment, the process of establishing a time-series-based security risk prediction model includes:

[0113] First, historical risk data is collected and a time series is established to form a time series dataset. Historical risk data includes actual and recorded risk data and events, as well as timestamps corresponding to the risk data and events, historical explicit risk level data, and historical implicit risk level data. Specifically, this involves collecting risk level data from the past three months, establishing a time series on an hourly basis, recording the number of high, medium, and low risk events and the main risk types each hour, thus forming a continuous time series dataset.

[0114] Then, based on the time series dataset, the temporal variation patterns and trend characteristics of risk level data are analyzed to establish a safety risk prediction model. Specifically, this includes: analyzing the distribution patterns of risk events, identifying high-risk periods (such as non-working hours), analyzing risk variation patterns over a 7-day week, and identifying weekdays or weekends with concentrated risks; establishing a basic time template to record the average risk level for each time period.

[0115] Another implementation method includes: counting the number of risk events occurring every hour, continuously collecting data for 30 days, and calculating the average number of events occurring in each time period; dividing a 24-hour day into working hours (9:00-18:00) and non-working hours (18:00-9:00 the next day), and counting the total number of events in each time period; marking a high-risk period when the number of risk events in a certain period exceeds 1.5 times the daily average; establishing a risk level label for each time period, marking periods with more than twice the average number of risk events as high-risk periods, more than 1.5 times as medium-risk periods, and less than the average number as low-risk periods; and outputting a risk period distribution table, clearly marking the daily high-risk time periods to provide a time reference for the allocation of security protection resources.

[0116] Establish basic time templates to record the average risk level for each time period. The specific operational logic includes: creating time grid templates based on a 24-hour day and a 7-day week, with each grid recording the average number of historical risk events for the corresponding time period; statistically analyzing the number of risk events for each time period over the past 30 days and calculating the average as the baseline risk level for that period; classifying risk levels into three levels: 0-2 events per day for low-risk periods, 3-5 events per day for medium-risk periods, and more than 6 events per day for high-risk periods; simultaneously recording the most frequent risk types for each time period, such as frequent abnormal login events at night and frequent abnormal permission events during working hours; and establishing a time template database that supports querying the baseline risk level for each time period by hour, day, and week, providing a historical baseline reference for risk prediction.

[0117] Calculate the trend of the number of risk events over 7 consecutive days, marking an upward trend as 1, a downward trend as -1, and a stable trend as 0; identify the changing patterns of risk types, such as whether SQL injection risks are increasing or privilege escalation risks are decreasing.

[0118] The moving average method is used to predict the risk level of each period in the next 24 hours based on the risk data of the same period in the past 7 days. The prediction results are adjusted by combining periodic patterns and trend characteristics, with the predicted value for weekdays multiplied by a coefficient of 1.2 and the predicted value for weekends multiplied by a coefficient of 0.8.

[0119] Finally, based on the security risk prediction model, predictive calculations are performed, outputting predicted risk data, predicted risk events, and predicted risk levels. The output includes: the predicted risk level (high, medium, low) for each time period within the next 24 hours, the most likely risk type (based on high-frequency risk types from the same historical period), and the probability of risk events occurring (based on the frequency of events from the same historical period), providing forward-looking guidance for security protection.

[0120] It should be noted that historical explicit risk level data and historical implicit risk level data can be statistically analyzed and predicted separately to obtain two safety risk prediction models with different parameters. The two safety risk prediction models can be used directly or further optimized and adjusted to unify the parameters. Either historical explicit risk level data or historical implicit risk level data can be used, or the higher of the two risk levels for the same event can be used, or a weighted average of the two can be used; there are no restrictions here.

[0121] Step S6: Obtain actual risk data and actual risk events. Based on the predicted risk data, the predicted risk events, the actual risk data, and the actual risk events, optimize the security event spatiotemporal correlation analysis algorithm, the security rule base, the risk assessment model, and the security risk prediction model.

[0122] In this embodiment, the process of optimizing the spatiotemporal correlation analysis algorithm for security events, the security rule base, the risk assessment model, and the security risk prediction model based on predicted risk data, predicted risk events, actual risk data, and actual risk events includes:

[0123] First, based on actual risk data and actual risk events, optimize the spatiotemporal correlation analysis algorithm for security events, the security rule base, and the risk assessment model. Actual risk events include first-type risk events, combinations of first-type risk events, and combinations of second-type risk events.

[0124] It should be noted that actual risk events and historical risk events are just small descriptions corresponding to different data application scenarios. For example, actual risk events mainly refer to the time period when there is predictive data, and the risk events and related information that occur when that time period is reached. Historical risk events correspond to the sample data when the model was built, without emphasizing whether there is corresponding predictive data.

[0125] Analyze the differences between the first and second risk event combinations and the first type of risk event. Add event combinations that occur more frequently than a preset threshold (e.g., 10 times) to the association rule base, and identify risk events more quickly through rule matching.

[0126] Analyze the spatiotemporal correlation between the first and second risk event combinations, and optimize the spatiotemporal correlation analysis algorithm and risk assessment model for safety events.

[0127] For example, when the system detects that an administrator account has performed a large number of data query operations during non-working hours (23:00-2:00 AM) for three consecutive days, and this is confirmed as an unauthorized access event, the system will automatically optimize the time window parameters of the spatiotemporal correlation algorithm, extending the detection window for continuous operations during non-working hours from the original 2 hours to 72 hours. At the same time, a rule for "repeated operations in the same time period for multiple consecutive days" will be added to the security rule base, and the risk weight coefficient for administrator operations during non-working hours will be increased in the risk assessment model from the original 1.5 times to 2.5 times, enabling the system to identify similar long-term attack behaviors earlier.

[0128] Then, the predicted risk data and predicted risk events are compared and analyzed with the actual risk data and actual risk events to calculate the prediction accuracy.

[0129] In one embodiment, the method includes: automatically collecting actual risk event data every 24 hours, comparing it with the prediction results of the previous day on a time-by-time basis, and calculating the prediction accuracy; recording the prediction as correct when a risk event actually occurs during a predicted high-risk period, and recording the prediction as incorrect when no event occurs; calculating the prediction accuracy over 7 consecutive days, and triggering a model optimization process when the accuracy is below 70%.

[0130] Finally, based on the prediction accuracy, the security risk prediction model is adjusted to obtain an optimized security risk prediction model.

[0131] Specific optimization methods include:

[0132] Association rule optimization: Analyze risk events that fail to predict and identify event combination patterns not covered by existing association rules; when a new event association pattern is found to occur more than 3 times consecutively, it is automatically added to the association rule library; for association rules that have not matched actual events for 30 consecutive days, they are marked as inefficient rules and their weights are reduced.

[0133] Risk assessment parameter adjustment: For event types that are misjudged as high-risk but have a small actual impact, the base score for such events will be appropriately lowered; for event types that are underestimated but have a serious actual impact, the base score will be increased accordingly; the scoring parameters will be fine-tuned once a week, with each adjustment not exceeding 5 points.

[0134] Improved prediction model accuracy: Adjust the time window size according to the prediction deviation. When the prediction is too high, the historical data window is extended from 7 days to 10 days, and when the prediction is too low, it is shortened to 5 days. Update the baseline risk level for each period and replace the historical baseline value with the data of the most recent 30 days.

[0135] Optimization effect verification: After each parameter adjustment, the optimization effect is verified using the data from the most recent 7 days. When the prediction accuracy improves by more than 5%, the optimization is confirmed to be effective; otherwise, the parameter settings before the adjustment are reverted to ensure system stability.

[0136] like Figure 2 As shown, this embodiment also provides a database security situation awareness system based on multi-source data fusion, including:

[0137] The database security information acquisition module is used to acquire multi-source heterogeneous security data;

[0138] The data format conversion module is used to generate unified format security data from the multi-source heterogeneous security data based on preset data format standards and preset conversion rules.

[0139] The risk identification module is used to identify risk data and risk events based on the unified format security data, through a security rule base and a security event spatiotemporal correlation analysis algorithm, and output the risk visibility level.

[0140] The risk assessment module is used to obtain the security situation and risk level based on the risk data and risk events, wherein the risk level includes explicit risk level and implicit risk level;

[0141] The risk prediction module is used for time-series-based security risk prediction models to obtain predicted risk data, predicted risk events, and predicted risk levels.

[0142] The feedback optimization module is used to acquire actual risk data and risk events, and based on the predicted risk data, the predicted risk events, and the acquired actual risk data and risk events, optimize the security event spatiotemporal correlation analysis algorithm, the security rule base and risk assessment model, and the security risk prediction model.

[0143] The functions and implementation methods of the above modules are the same as the corresponding steps in the aforementioned method embodiments, and will not be repeated here.

[0144] The database security situation awareness method and system based on multi-source data fusion provided by this invention solves the problems of scattered security data and inconsistent formats by unifying the collection and standardizing the format of multi-source heterogeneous security data; it breaks through the limitations of traditional single-point security detection by using an innovative security event spatiotemporal correlation analysis algorithm; it achieves accurate risk level classification by constructing a database security situation quantitative assessment model based on machine learning; it has a forward-looking threat warning capability by establishing a security risk prediction model; and it achieves continuous optimization and accuracy improvement of the model by forming a closed-loop feedback optimization mechanism.

[0145] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

[0146] Furthermore, it should be understood that although this specification describes embodiments, not every embodiment contains only one independent technical solution. This narrative style is merely for clarity. Those skilled in the art should consider the specification as a whole, and the technical solutions in each embodiment can also be appropriately combined to form other embodiments that can be understood by those skilled in the art.

[0147] like Figure 3 This is a schematic diagram of a computer device provided for an embodiment of the present disclosure. It illustrates a structural schematic diagram suitable for implementing the computer device in the embodiments of the present disclosure. Figure 3 The computer device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments disclosed herein.

[0148] A computer device according to embodiments of the present disclosure includes a memory and a processor. The memory is used to store non-transitory computer-readable instructions. Specifically, the memory may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may, for example, include random access memory (RAM) and / or cache memory. The non-volatile memory may, for example, include read-only memory (ROM), hard disk, flash memory, etc.

[0149] The processor may be a central processing unit (CPU) or other form of processing unit with data processing capabilities and / or instruction execution capabilities, and may control other components in the computer device to perform desired functions. In one embodiment of this disclosure, the processor is used to execute computer-readable instructions stored in the memory, causing the computer device to perform all or part of the steps of the multi-source data fusion database security situation awareness method of the foregoing embodiments of this disclosure.

[0150] Those skilled in the art will understand that, in order to solve the technical problem of how to achieve a good user experience, this embodiment may also include well-known structures such as communication buses and interfaces, and these well-known structures should also be included within the protection scope of this disclosure.

[0151] like Figure 3 This is a schematic diagram of a computer device provided for an embodiment of the present disclosure. It illustrates a structural schematic diagram suitable for implementing the computer device in the embodiments of the present disclosure. Figure 3 The computer device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments disclosed herein.

[0152] like Figure 3 As shown, a computer device may include a processor (such as a central processing unit, graphics processing unit, etc.), which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) or programs loaded from storage devices into random access memory (RAM). The RAM also stores various programs and data required for the operation of the computer device. The processor, ROM, and RAM are interconnected via a bus. Input / output (I / O) interfaces are also connected to the bus.

[0153] Typically, the following devices can be connected to the I / O interface: input devices, such as sensors or visual information acquisition devices; output devices, such as displays; storage devices, such as magnetic tapes or hard drives; and communication devices. Communication devices allow the computer device to communicate wirelessly or wiredly with other devices (such as edge computing devices) to exchange data. Although Figure 3A computer apparatus with various devices is shown, but it should be understood that it is not required to implement or have all of the devices shown. More or fewer devices may be implemented or included alternatively.

[0154] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from a storage device, or installed from a ROM. When the computer program is executed by a processor, all or part of the steps of the multi-source data fusion database security situation awareness method of embodiments of this disclosure are performed.

[0155] For a detailed description of this embodiment, please refer to the corresponding descriptions in the foregoing embodiments, which will not be repeated here.

[0156] A computer-readable storage medium according to embodiments of the present disclosure stores non-transitory computer-readable instructions. When these non-transitory computer-readable instructions are executed by a processor, all or part of the steps of the multi-source data fusion database security situation awareness method described in the foregoing embodiments of the present disclosure are performed.

[0157] The aforementioned computer-readable storage media include, but are not limited to: optical storage media (e.g., CD-ROM and DVD), magneto-optical storage media (e.g., MO), magnetic storage media (e.g., magnetic tape or portable hard drive), media with built-in rewritable non-volatile memory (e.g., memory card), and media with built-in ROM (e.g., ROM cartridge).

[0158] For a detailed description of this embodiment, please refer to the corresponding descriptions in the foregoing embodiments, which will not be repeated here.

[0159] The basic principles of this disclosure have been described above with reference to specific embodiments. However, it should be noted that the advantages, benefits, and effects mentioned in this disclosure are merely examples and not limitations, and should not be considered as essential features of each embodiment of this disclosure. Furthermore, the specific details disclosed above are for illustrative and facilitative purposes only, and are not limitations. These details do not limit the scope of this disclosure to the necessity of employing the aforementioned specific details for implementation.

[0160] In this disclosure, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. The block diagrams of devices, apparatuses, devices, and systems involved in this disclosure are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, apparatuses, devices, and systems can be connected, arranged, and configured in any manner. Words such as "comprising," "including," "having," etc., are open-ended terms meaning "including but not limited to," and are used interchangeably with them. The terms "or" and "and" as used herein refer to the terms "and / or," and are used interchangeably with them unless the context clearly indicates otherwise. The term "such as" as used herein refers to the phrase "such as but not limited to," and is used interchangeably with it.

[0161] Additionally, as used herein, the "or" used in a list of items beginning with "at least one" indicates a separate list, such that a list of, for example, "at least one of A, B, or C" means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the word "exemplary" does not imply that the described example is preferred or better than other examples.

[0162] It should also be noted that in the systems and methods of this disclosure, the components or steps can be decomposed and / or recombined. These decompositions and / or recombinations should be considered as equivalent solutions to this disclosure.

[0163] Various changes, substitutions, and modifications can be made to the technology described herein without departing from the teachings defined by the appended claims. Furthermore, the scope of the claims of this disclosure is not limited to the specific aspects of the processes, machines, manufactures, events, means, methods, and actions described above. Currently existing or later-developed processes, machines, manufactures, events, means, methods, or actions that perform substantially the same function or achieve substantially the same result as the corresponding aspects described herein can be utilized. Therefore, the appended claims include such processes, machines, manufactures, events, means, methods, or actions within their scope.

[0164] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use this disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of this disclosure. Therefore, this disclosure is not intended to be limited to the aspects shown herein, but rather to be carried out within the widest scope consistent with the principles and novel features disclosed herein.

[0165] The above description has been given for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of this disclosure to the forms disclosed herein. Although numerous exemplary aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations therein.

Claims

1. A database security situation awareness method based on multi-source data fusion, characterized in that, include: Acquire multi-source heterogeneous security data; By using preset data format standards and preset conversion rules, multi-source heterogeneous security data is generated into security data in a unified format; Based on security data in a unified format, risk data and risk events are identified through a security rule base and a security event spatiotemporal correlation analysis algorithm, and the risk explicitness level is output. Risk events include Category I risk events and Category II risk events. Category II risk events include combinations of Category I risk events and combinations of Category II risk events. A risk assessment model based on machine learning is constructed. Based on risk data and risk events, the security situation and risk latent level are obtained. The risk level includes the risk explicit level and the risk latent level. Establish a time-series-based security risk prediction model to obtain predicted risk data, predicted risk events, and predicted risk levels; Obtain actual risk data and actual risk events, including Category I risk events, combinations of Category I risk events, and combinations of Category II risk events; Based on actual risk data and actual risk events, optimize the spatiotemporal correlation analysis algorithm for security events, the security rule base, and the risk assessment model; The predicted risk data and predicted risk events are compared and analyzed with the actual risk data and actual risk events to calculate the prediction accuracy. Based on the prediction accuracy, the security risk prediction model is adjusted to obtain an optimized security risk prediction model. Based on security data in a unified format, risky data and risky events are identified through a security rule base and a spatiotemporal correlation analysis algorithm for security events, including: Using a pre-defined security rule base, rule matching is performed on security data in a uniform format to mark risky data and Category I risk events; Based on the spatiotemporal correlation analysis algorithm for security events, the correlation of abnormal security events is judged in both the time dimension and the spatial dimension, resulting in a first risk event combination that is correlated in time and a second risk event combination that is correlated in space. Based on risk data, Category I risk events, and Category II risk events, output a list of risk events and risk visibility levels; Relationship assessment over time includes: Within the same preset time window, detect whether there are multiple security events, identify abnormal events and abnormal time correlations, and obtain the first risk event combination that is correlated in time; Determining spatial correlation includes: Based on spatial elements, multiple security events from the same target object are analyzed to identify abnormal events and abnormal spatial correlations, resulting in a second risk event combination that is spatially correlated. Among them, the spatial elements include at least one of IP address, user account, and database instance, and the target object is one of user object, database instance object, device object, and system object.

2. The method according to claim 1, characterized in that, The acquisition of multi-source heterogeneous security data includes: Through standardized interfaces, we collect operation logs from the database auditing system, operating parameters from the status monitoring system, security vulnerability information from the vulnerability scanning system, and sensitive data processing records from the de-identification system.

3. The method according to claim 1, characterized in that, The preset data format standard and preset conversion rules include one of the following rules: Timestamp rules, data structure rules, or data type rules; The timestamp rule is to identify the format type of the original timestamp in the multi-source heterogeneous security data, parse and extract time information and obtain the corresponding time zone information, and convert the original timestamp into UTC time format. The data structure rule is to parse the raw data of different formats in the multi-source heterogeneous security data, extract key field information, and convert it into a standard data structure including event ID, device identifier, event type, severity level, and description information; The data type rules are used to identify alarm messages, log messages, status messages, and event messages in the multi-source heterogeneous security data, and convert them into standard message classifications and standard message tags.

4. The method according to claim 1, characterized in that, The construction of the machine learning-based risk assessment model includes: Key features are extracted from historical risk data and historical risk events to form a feature vector. The historical risk events include the first type of risk events, combinations of the first risk events, and combinations of the second risk events. Based on the aforementioned feature vectors, the risk assessment model is established. The risk assessment model is input into the currently detected risk data, the first type of risk event, the combination of the first risk event, and the combination of the second risk event, and the risk latent level is output.

5. The method according to claim 1, characterized in that, The establishment of a time-series-based security risk prediction model includes: Collect historical risk data, establish time series, and form a time series dataset. The historical risk data includes risk data, risk events, and timestamps corresponding to the risk data and risk events, as well as historical explicit risk level data and historical implicit risk level data. Based on the time series dataset, the temporal variation patterns and trend characteristics of the risk level data are analyzed, and the safety risk prediction model is established. Based on the security risk prediction model, prediction calculations are performed, and the predicted risk data, the predicted risk events, and the predicted risk level are output.

6. A database security situation awareness system based on multi-source data fusion, characterized in that, include: The database security information acquisition module is used to acquire multi-source heterogeneous security data; The data format conversion module is used to generate unified format security data from multi-source heterogeneous security data based on preset data format standards and preset conversion rules. The risk identification module is used to identify risk data and risk events based on security data in a unified format, through a security rule base and a security event spatiotemporal correlation analysis algorithm, and output the risk explicitness level. Risk events include Category I risk events and Category II risk events. Category II risk events include combinations of Category I risk events and combinations of Category II risk events. The risk assessment module is used to build a machine learning-based risk assessment model. Based on risk data and risk events, it obtains the security situation and risk level, which includes explicit risk level and implicit risk level. The risk prediction module is used to build a time-series-based security risk prediction model to obtain predicted risk data, predicted risk events, and predicted risk levels. The feedback optimization module is used to acquire actual risk data and risk events. Actual risk events include first-type risk events, combinations of first-type risk events, and combinations of second-type risk events. Based on actual risk data and actual risk events, optimize the spatiotemporal correlation analysis algorithm for security events, the security rule base, and the risk assessment model; compare and analyze the predicted risk data and predicted risk events with the actual risk data and actual risk events to calculate the prediction accuracy; based on the prediction accuracy, adjust the security risk prediction model to obtain the optimized security risk prediction model. Based on security data in a unified format, risky data and risky events are identified through a security rule base and a spatiotemporal correlation analysis algorithm for security events, including: Using a pre-defined security rule base, rule matching is performed on security data in a uniform format to mark risky data and Category I risk events; Based on the spatiotemporal correlation analysis algorithm for security events, the correlation of abnormal security events is judged in both the time dimension and the spatial dimension, resulting in a first risk event combination that is correlated in time and a second risk event combination that is correlated in space. Based on risk data, Category I risk events, and Category II risk events, output a list of risk events and risk visibility levels; Relationship assessment over time includes: Within the same preset time window, detect whether there are multiple security events, identify abnormal events and abnormal time correlations, and obtain the first risk event combination that is correlated in time; Determining spatial correlation includes: Based on spatial elements, multiple security events from the same target object are analyzed to identify abnormal events and abnormal spatial correlations, resulting in a second risk event combination that is spatially correlated. Among them, the spatial elements include at least one of IP address, user account, and database instance, and the target object is one of user object, database instance object, device object, and system object.

Images