Data operation auditing method and device for background database, equipment and medium
By generating structured logic trees and knowledge graphs to identify abnormal operation elements, and combining this with an operation log auditing framework, the problem of low efficiency and accuracy in auditing backend database data operations has been solved, achieving efficient closed-loop management of approval and auditing.
Patent Information
- Application Number
- CN202511377553.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-09-24
- Publication Date
- 2025-12-19
AI Technical Summary
In existing technologies, the efficiency and accuracy of data operation auditing in the back-end database are low, relying on manual processes is complex, and approval and auditing are disconnected.
By acquiring target data operation approval work orders, extracting key operation elements to generate a structured logic tree, combining it with a knowledge graph of preset business approval strategies and data security rules, identifying abnormal operation elements, constructing an operation log audit detection framework, and generating a difference analysis report to determine the audit results.
It improved the efficiency and accuracy of data operation approval and auditing, reduced reliance on manual labor, and established a closed-loop management system.
Smart Images
Figure CN121168436A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the field of computers, in particular to a data operation auditing method, device and equipment of a background database and a medium. BACKGROUND
[0002] The data query and operation of an operation and maintenance personnel facing a background database is an important link of organizing data security management, and the usual protection measures and means are:
[0003] (1) Construct a data operation approval platform, usually describe the data query and operation demand with natural language, realize multi-post approval of data operation, and record the work order, and this platform usually only considers business demand.
[0004] (2) Construct a data operation work platform, such as a bastion host, a cloud desktop, a data management and control platform, etc. to control the data operation process, ensure that the specific operation of data operation has log record or video recording, and keep the data operation script.
[0005] (3) Carry out data operation security audit, carry out data security audit through the audit capability of the data operation work platform or the audit capability of the database log audit system, and the method includes structured log audit and user behavior analysis.
[0006] In summary, how to improve the approval and audit efficiency and accuracy is a problem to be solved at present. SUMMARY
[0007] Therefore, the purpose of the present application is to provide a data operation auditing method, device, equipment and medium of a background database, which can improve the approval and audit efficiency and accuracy. The specific scheme is as follows:
[0008] In the first aspect, the present application provides a data operation auditing method of a background database, comprising:
[0009] Obtain a target data operation approval work order, extract key operation elements in the target data operation approval work order through a preset entity recognition channel, generate a target structured logic tree based on the key operation elements by using a preset logic reasoning channel, and convert the target structured logic tree into a target standard approval template; the target data operation approval work order is an approval work order for a target data operation of a background database;
[0010] Determine a target strategy knowledge graph based on a preset business approval strategy and a preset data security audit rule, and identify abnormal key operation elements in the target data operation approval work order that meet abnormal event conditions according to the target strategy knowledge graph;
[0011] obtaining a first abstract syntax tree of the target standard approval template and a second abstract syntax tree of an actual target data operation, determining a target edit distance between the first abstract syntax tree and the second abstract syntax tree, and generating a corresponding target difference analysis report based on the target edit distance;
[0012] According to the preset dimension, an operation log audit detection framework is constructed, and based on the operation log data, the abnormal key operation elements and the target difference analysis report, an audit result corresponding to the target data operation approval work order is determined by using the operation log audit detection framework.
[0013] Optionally, the method further comprises:
[0014] The key operation elements are subjected to confidence value verification to generate a corresponding target confidence degree.
[0015] It is judged whether the target confidence degree is less than a preset threshold value.
[0016] If the target confidence degree is less than the preset threshold value, the key operation elements are subjected to manual auditing operation.
[0017] If the target confidence degree is not less than the preset threshold value, a target structured logic tree is generated based on the key operation elements by using a preset logic reasoning channel.
[0018] Optionally, the target strategy knowledge graph is determined based on the preset business approval strategy and the preset data security audit rule, comprising:
[0019] An initial graph structure containing preset business approval strategy nodes and preset data security audit rule nodes is created by using Neo4j;
[0020] Attribute information of the preset business approval strategy nodes and the preset data security audit rule nodes is added in the initial graph structure, and mapping connections between nodes are established based on a preset business logic association relationship, so as to generate an initial strategy knowledge graph;
[0021] The initial strategy knowledge graph is verified, and a target strategy knowledge graph is determined according to a verification result.
[0022] Optionally, the initial strategy knowledge graph is verified, and a target strategy knowledge graph is determined according to a verification result, comprising:
[0023] Strategy conflict nodes in the initial strategy knowledge graph are detected by using a graph neural network;
[0024] A strategy conflict matrix is determined according to a detection result obtained;
[0025] The policy conflict matrix is subjected to a preset conflict arbitration operation to generate a verification result of the initial policy knowledge graph, and a target policy knowledge graph is determined according to the verification result.
[0026] Optionally, the corresponding target difference analysis report is generated based on the target edit distance, including:
[0027] It is judged whether the target edit distance exists in a first preset edit distance interval;
[0028] If the target edit distance exists in the first preset edit distance interval, the actual target data operation is recorded;
[0029] It is judged whether the target edit distance exists in a second preset edit distance interval;
[0030] If the target edit distance exists in the second preset edit distance interval, the actual target data operation is suspended and manual auditing is performed;
[0031] It is judged whether the target edit distance exists in a third preset edit distance interval;
[0032] If the target edit distance exists in the third preset edit distance interval, the actual target data operation is directly blocked.
[0033] Optionally, the preset dimensions include time dimension, space dimension, and personnel dimension.
[0034] Optionally, the method further includes:
[0035] Based on the operation log data, the abnormal key operation element, and the target difference analysis report, a corresponding SQL script of the user end is determined;
[0036] The SQL script is converted into a corresponding intermediate representation;
[0037] According to the intermediate representation, a corresponding target mapping table is determined by using a taint analysis technique to mark and track a sensitive field propagation path;
[0038] Based on the target mapping table, a business intention of the user end is determined.
[0039] In a second aspect, the present application provides a data operation auditing device of a background database, including:
[0040] A template conversion module is configured to obtain a target data operation approval work order, extract key operation elements in the target data operation approval work order through a preset entity recognition channel, generate a target structured logic tree based on the key operation elements by using a preset logic reasoning channel, and convert the target structured logic tree into a target standard approval template.
[0041] An element identification module is configured to determine a target policy knowledge graph based on a preset business approval policy and a preset data security audit rule, and identify an abnormal key operation element meeting an abnormal event condition in the target data operation approval work order according to the target policy knowledge graph.
[0042] A report generation module is configured to obtain a first abstract syntax tree of the target standard approval template and a second abstract syntax tree of an actual target data operation, determine a target edit distance of the first abstract syntax tree and the second abstract syntax tree, and generate a corresponding target difference analysis report based on the target edit distance.
[0043] An audit result determination module is configured to construct an operation log audit detection framework according to a preset dimension, and determine an audit result corresponding to the target data operation approval work order based on operation log data, the abnormal key operation element and the target difference analysis report by using the operation log audit detection framework.
[0044] In a third aspect, the present application provides an electronic device, comprising:
[0045] A memory is configured to save a computer program.
[0046] A processor is configured to execute the computer program to implement the data operation audit method of the background database as described above.
[0047] In a fourth aspect, the present application provides a computer readable storage medium configured to save a computer program; wherein the computer program is executed by a processor to implement the data operation audit method of the background database as described above.
[0048] In summary, the application first acquires a target data operation approval work order, extracts key operation elements in the target data operation approval work order through a preset entity recognition channel, generates a target structured logic tree based on the key operation elements using a preset logical reasoning channel, converts the target structured logic tree into a target standard approval template; determines a target strategy knowledge graph based on a preset business approval strategy and a preset data security audit rule, identifies abnormal key operation elements in the target data operation approval work order that meet abnormal event conditions according to the target strategy knowledge graph; acquires a first abstract syntax tree of the target standard approval template and a second abstract syntax tree of actual target data operation, determines a target edit distance of the first abstract syntax tree and the second abstract syntax tree, and generates a corresponding target difference analysis report based on the target edit distance; constructs an operation log audit detection framework according to a preset dimension, and determines an audit result corresponding to the target data operation approval work order based on operation log data, the abnormal key operation elements and the target difference analysis report using the operation log audit detection framework. As can be seen from the above, the target data operation approval work order is first acquired, the key operation elements therein are extracted through a preset entity recognition channel, and a target structured logic tree is generated based on these key operation elements using a preset logical reasoning channel, and is converted into a target standard approval template; then a target strategy knowledge graph is determined based on a preset business approval strategy and a preset data security audit rule, and abnormal key operation elements in the work order that meet abnormal event conditions are identified according to the graph; then a first abstract syntax tree of the target standard approval template and a second abstract syntax tree of actual target data operation are acquired, the target edit distance of the two is determined and a corresponding target difference analysis report is generated; finally, an operation log audit detection framework is constructed according to a preset dimension, and the audit result corresponding to the target data operation approval work order is determined based on operation log data, abnormal key operation elements and the target difference analysis report using the framework. In this way, in view of the pain points of disconnection between data operation approval and audit, complex audit relying on manual work and the like, the capabilities of large models in natural language processing, anomaly detection, automated review and the like are integrated, the existing system is combined, a closed-loop management system is established, and the efficiency and accuracy of approval and audit are improved. BRIEF DESCRIPTION OF DRAWINGS
[0049] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed in the embodiments or prior art description will be briefly introduced below. Obviously, the drawings in the following description are only embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor on the basis of the provided drawings.
[0050] Figure 1 A data operation audit method flowchart of a background database disclosed by the present application;
[0051] Figure 2 A specific data operation audit method flowchart of a background database disclosed in the present application;
[0052] Figure 3 A specific data operation audit method flowchart of a background database disclosed in the present application;
[0053] Figure 4 A structural schematic diagram of a data operation audit device of a background database disclosed in the present application;
[0054] Figure 5 A structural diagram of an electronic device disclosed in the present application. DETAILED DESCRIPTION
[0055] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of protection of the present application.
[0056] Currently, the data query and operation of the operation and maintenance personnel facing the background database is an important link of organizing data security management. The common protection measures and means are as follows: constructing a data operation approval platform, usually using natural language to describe the data query and operation requirements, realizing multi-post approval and work order record of data operation, and this platform usually only considers business requirements. Constructing a data operation work platform, such as a bastion host, a cloud desktop, a data management and control platform, etc. to control the data operation process, to ensure that the specific operation of data operation has log record or video recording, and to leave data operation script. Developing data operation security audit, through the audit capability of the data operation work platform or the audit capability of the database log audit system to develop data security audit, the methods including structured log audit and user behavior analysis. In order to solve the above technical problems, the present application discloses a data operation audit method, device, equipment and medium of a background database, which can improve the approval and audit efficiency and accuracy.
[0057] Referring to Figure 1 As shown in the figure, the embodiment of the present application discloses a data operation audit method of a background database, comprising:
[0058] In step S11, an operation approval work order is obtained, key operation elements in the operation approval work order are extracted through a preset entity recognition channel, a target structured logic tree is generated based on the key operation elements by using a preset logic reasoning channel, and the target structured logic tree is converted into a target standard approval template. The target data operation approval work order is an approval work order for a target data operation of a background database.
[0059] In this embodiment, first, an approval work order for a target data operation of a background database, i.e., a target data operation approval work order, is obtained. An entity recognition large model is connected through a preset entity recognition channel to perform named entity recognition on the data operation approval work order and extract key operation elements such as an operator, an operation time range, an operation object, an action type, and a constraint condition, and generate an expected result and a verification condition. In this process, a certain scale of adversarial samples can be injected, such as intentionally scrambling the order of words in the work order, to improve the recognition robustness. The key operation elements can be further refined in granularity by labels, such as the operation object being further split into an application system, a database name, a data table name, and a field name. Then, a logic reasoning large model is connected by using a preset logic reasoning channel, a structured logic tree is generated based on the key operation elements by the model, and the structured logic tree is then mapped to a target standard approval template as a data operation benchmark this time. It should be noted that a version rollback mechanism can be designed for the approval template. When the generated template triggers multiple alarms, the system automatically switches to a historical stable version.
[0060] In addition, the key operation elements need to be verified for a confidence value to generate a corresponding target confidence. It is determined whether the target confidence is less than a preset threshold. If the target confidence is less than the preset threshold, the key operation elements are subjected to manual auditing. If the target confidence is not less than the preset threshold, a target structured logic tree is generated based on the key operation elements by using a preset logic reasoning channel. Specifically, after the entity recognition model completes entity recognition and key element extraction, the key operation elements are subjected to confidence verification. If the confidence is greater than a preset threshold, the key operation elements enter a logic reasoning channel. Otherwise, the key operation elements are transferred to a manual auditing process. The key operation elements subjected to manual auditing are reviewed and corrected by an auditor in combination with domain knowledge and actual business scenarios, and are reimported into a logic reasoning large model after being confirmed to be correct to generate a target structured logic tree.
[0061] In step S12, a target strategy knowledge graph is determined based on a preset business approval strategy and a preset data security audit rule, and abnormal key operation elements that meet abnormal event conditions in the target data operation approval work order are identified according to the target strategy knowledge graph.
[0062] In this embodiment, Neo4j is used to create an initial graph structure containing preset business approval policy nodes and preset data security audit rule nodes; attribute information of the preset business approval policy nodes and the preset data security audit rule nodes is added in the initial graph structure, and mapping connections between the nodes are established based on preset business logic association relationships to generate an initial policy knowledge graph; the initial policy knowledge graph is verified, and a target policy knowledge graph is determined according to a verification result. Specifically, based on Neo4j, the business approval policy and the data security audit rule are associated, the business approval policy can include business department batch export restriction, etc., the data security audit rule can include sensitive information processing requirement, etc., the association relationship covers types such as department and policy, policy and policy, and an initial graph structure is constructed. Then attribute information is added to the policy nodes in the initial graph structure, the attribute information includes effective time, priority, and applicable scope, the applicable scope can be specifically divided into test environment, production environment, etc., and an initial policy knowledge graph is obtained. Then, a graph neural network is used to detect policy conflict nodes in the initial policy knowledge graph; a policy conflict matrix is determined according to a detection result obtained; a preset conflict arbitration operation is performed on the policy conflict matrix to generate a verification result of the initial policy knowledge graph, and a target policy knowledge graph is determined according to the verification result. Specifically, GNN (Graph Neural Network) is used to detect policy conflict nodes, a 2-layer graph neural network can be used, a loss function is configured, a policy conflict matrix is generated, and conflict types such as field deviation, permission overlap, logic contradiction, and out-of-range are labeled, and the policy conflict matrix is automatically arbitrated through preset rules to determine the target policy knowledge graph. In addition, the matching degree of the target data operation approval work order and the department responsibility can be calculated based on an attention mechanism, and a department joint review node is automatically added for high-risk operations.
[0063] In step S13, a first abstract syntax tree of the target standard approval template and a second abstract syntax tree of the actual target data operation are obtained, a target edit distance of the first abstract syntax tree and the second abstract syntax tree is determined, and a corresponding target difference analysis report is generated based on the target edit distance.
[0064] In this embodiment, the target standard approval template is parsed into a first abstract syntax tree, and the actual target data operation is parsed into a second abstract syntax tree. Then, the target edit distance of the first abstract syntax tree and the second abstract syntax tree is determined, and it is judged whether the target edit distance exists in the first preset edit distance interval; if the target edit distance exists in the first preset edit distance interval, the actual target data operation is recorded; it is judged whether the target edit distance exists in the second preset edit distance interval; if the target edit distance exists in the second preset edit distance interval, the actual target data operation is suspended and artificial review is performed; it is judged whether the target edit distance exists in the third preset edit distance interval; if the target edit distance exists in the third preset edit distance interval, the actual target data operation is directly blocked. Specifically, based on the preset dynamic threshold interval, a difference alarm can be triggered in the actual execution operation, for example, when the target edit distance is between 1-2, only the log is recorded; when the target edit distance is between 3-4, the execution is suspended and a work order is notified to the business and security personnel for review; when the target edit distance is 5 or above, the operation is blocked. In addition, operation context features such as operator identity and level, database / table security level, operation space-time features, and other data can be added to adjust the target edit distance or the preset dynamic threshold interval. Finally, a target difference analysis report is generated according to the target edit distance, which is used for reference for subsequent data security audit.
[0065] Step S14, constructing an operation log audit detection framework according to a preset dimension, using the operation log audit detection framework to determine an audit result corresponding to the target data operation approval work order based on operation log data, the abnormal key operation elements and the target difference analysis report.
[0066] In this embodiment, an operation log audit detection framework is constructed from three dimensions of time, space and personnel. The target data operation approval work order memory audit is performed using the operation log audit detection framework. The time dimension needs to be labeled in combination with business events and abnormal events. Business events cover system upgrades, business peaks and other scenarios. Subsequently, operation time sequence features are encoded using Time2Vec at three granularities of hour, day and week. Unconventional time patterns are then identified through the encoding results, such as batch export behavior at 3 am. The space dimension learns from historical logs using the GraphSAGE algorithm to extract compliant network topology features as a baseline. Based on a streaming processing mechanism, access paths in the operation log are detected in real time, and the Jaccard similarity between the path and the baseline is calculated to identify unconventional access paths, such as bypassing the bastion host to directly connect to the database. When extracting network topology features, a hierarchical sampling strategy can be used to sample 3 layers of neighbors for core nodes such as databases, and 1 layer of neighbors for edge nodes such as terminals. The personnel dimension needs to be associated with personnel's post permissions, historical operation records and other information to construct a personnel operation behavior baseline. Deviations between real-time operations and the baseline are compared to identify abnormalities, such as sensitive data query operations outside the permission range. Finally, the audit results of each dimension are integrated to generate the required audit results.
[0067] It should be noted that, in order to construct the operation log audit detection framework, regular rule matching can be used for detection. For example, for specific and clearly risk-featured statements, pre-set regular rules can be used for direct matching and identification. Secondly, isolated forest algorithm is used to identify statistical anomalies, which can discover operations deviating from normal patterns based on the distribution characteristics of the data, such as batch export behavior at 3 am or a 100-fold increase in single-day operation frequency compared to the regular case. Thirdly, the CodeBERT model is fine-tuned to analyze the deep semantics of SQL (Structured Query Language), which can be used to judge the deep semantic level of some operations with strong disguising ability, such as test disguised deletion operations. During model training, a certain base of SQL statements needs to be labeled to distinguish between normal and malicious labels, with a ratio of 7:3. At the same time, a certain scale of disturbance samples can be injected into the training data, such as adding useless comments, performing case conversion, etc., to enhance the model's adaptability to complex situations. In addition, to avoid regular rule matching filtering out some logs that need deep semantic analysis, logs that match regular rule analysis still need to enter the analysis process of other dimensions, but their priority can be set to low.
[0068] As can be known from the above, the embodiment of the application first acquires a target data operation approval work order, extracts key operation elements therefrom through a preset entity recognition channel, generates a target structured logic tree based on the key operation elements by using a preset logic reasoning channel, and converts the target structured logic tree into a target standard approval template; then determines a target strategy knowledge graph based on a preset business approval strategy and a preset data security audit rule, and identifies abnormal key operation elements in the work order that meet abnormal event conditions according to the graph; then acquires a first abstract syntax tree of the target standard approval template and a second abstract syntax tree of actual target data operation, determines a target edit distance of the two trees, and generates a corresponding target difference analysis report; finally, constructs an operation log audit detection framework according to a preset dimension, and determines an audit result corresponding to the target data operation approval work order based on operation log data, abnormal key operation elements and the target difference analysis report by using the framework. In this way, the pain points of disconnection between data operation approval and audit and reliance on manual complex audit are addressed, the capabilities of large models in natural language processing, anomaly detection and automated review are integrated, the existing system is combined, a closed-loop management system is established, and the efficiency and accuracy of approval and audit are improved.
[0069] Referring to Figure 2 As shown in the figure, in order to understand the business intention of the operator in the audit process, the embodiment of the application discloses a data operation audit method of a background database, comprising:
[0070] Step S21, determining a SQL script corresponding to the user end based on operation log data, the abnormal key operation elements and the target difference analysis report.
[0071] In this embodiment, the SQL script executed by the user end is located according to the obtained operation log data, the abnormal key operation elements and the target difference analysis report.
[0072] Step S22, converting the SQL script into a corresponding intermediate representation.
[0073] In this embodiment, the operation type, target object, constraint condition, influence row number estimation and other key elements in the SQL script are retained to prevent loss of business details caused by abstraction, and the SQL script is converted into a corresponding intermediate representation.
[0074] Step S23, determining a corresponding target mapping table by using a taint analysis technique to mark and track sensitive field propagation paths according to the intermediate representation.
[0075] In this embodiment, the taint analysis technique is used to mark and track sensitive field propagation paths, and a target mapping table of IR to a business scenario is established and dynamically updated, for example, a “DELETE” operation is corresponded to a “user logout / form cancellation” business scenario.
[0076] In this embodiment, by means of the correspondence between the intermediate representation in the target mapping table and the business scenario, combined with the restoration of the operation scenario in the reverse analysis, such as restoring the corresponding business scenario when involving the DELETE operation, analyzing the operation audit bypassing through the stored procedure, and the like, the business intention of the user end can be accurately determined.
[0077] As can be seen from the above, the embodiments of the present application can accurately determine the target by integrating multiple types of information, avoid missing or misjudgment caused by single information, convert the SQL into an intermediate representation and retain key elements, eliminate the hindrance of syntax differences, ensure that the business details are not lost, and guarantee that the subsequent analysis is in line with the actual scenario. By means of the target mapping table determined by the taint analysis and the intermediate representation, the propagation track of the sensitive field can be mastered, and the stable association between the operation and the business scenario can be established. Combined with the target mapping table and the reverse analysis, the confusing nature of the complex SQL can be broken through, the business logic behind the operation can be restored, and the deep motivation of the user operation can be understood.
[0078] Based on the above embodiment, the present application discloses a data operation audit method of a background database, which can improve the efficiency and accuracy of approval and audit. Next, taking the audit of bank fund change operation as an example, the data operation audit method of the background database of the bank as shown in Figure 3 is described in detail.
[0079] Firstly, the present application obtains a bank fund change operation approval work order, extracts key operation elements in the bank fund change operation approval work order through a bank work order special entity recognition channel, generates a fund operation structured logic tree based on the key operation elements by using a bank risk control logic reasoning channel, and converts the fund operation structured logic tree into a standard approval template of the bank fund change operation.
[0080] Next, a bank risk control strategy knowledge graph is determined based on a bank business approval strategy and a financial data security audit rule, and abnormal fund operation elements that meet abnormal event conditions in the bank fund change operation approval work order are identified according to the bank risk control strategy knowledge graph.
[0081] Then, a first abstract syntax tree of the standard approval template and a second abstract syntax tree of the actual fund change operation are obtained, a target edit distance of the first abstract syntax tree and the second abstract syntax tree is determined, and a corresponding fund operation difference analysis report is generated based on the target edit distance.
[0082] Finally, a fund operation log audit detection framework is constructed according to a pre-set bank business supervision dimension, and an audit result corresponding to the bank fund change operation approval work order is determined based on bank operation log data, the abnormal fund operation elements and the fund operation difference analysis report by using the fund operation log audit detection framework.
[0083] Referring to Figure 4 As shown in the drawings, the embodiment of the application discloses a data operation audit device of a background database, comprising:
[0084] The template conversion module 11 is configured to obtain a target data operation approval work order, extract key operation elements in the target data operation approval work order through a preset entity recognition channel, generate a target structured logic tree based on the key operation elements by using a preset logical reasoning channel, and convert the target structured logic tree into a target standard approval template.
[0085] The element recognition module 12 is configured to determine a target strategy knowledge graph based on a preset business approval strategy and a preset data security audit rule, and identify abnormal key operation elements that meet abnormal event conditions in the target data operation approval work order according to the target strategy knowledge graph.
[0086] The report generation module 13 is configured to obtain a first abstract syntax tree of the target standard approval template and a second abstract syntax tree of an actual target data operation, determine a target edit distance of the first abstract syntax tree and the second abstract syntax tree, and generate a corresponding target difference analysis report based on the target edit distance.
[0087] The audit result determination module 14 is configured to construct an operation log audit detection framework according to a preset dimension, and determine an audit result corresponding to the target data operation approval work order based on operation log data, the abnormal key operation elements, and the target difference analysis report by using the operation log audit detection framework.
[0088] As can be seen from the above, the application first obtains a target data operation approval work order, extracts key operation elements therein through a preset entity recognition channel, and then generates a target structured logic tree based on these key operation elements by using a preset logical reasoning channel, and converts the target structured logic tree into a target standard approval template. Then, a target strategy knowledge graph is determined based on a preset business approval strategy and a preset data security audit rule, and abnormal key operation elements that meet abnormal event conditions in the work order are identified according to the graph. Then, a first abstract syntax tree of the target standard approval template and a second abstract syntax tree of an actual target data operation are obtained, a target edit distance of the two trees is determined, and a corresponding target difference analysis report is generated. Finally, an operation log audit detection framework is constructed according to a preset dimension, and an audit result corresponding to the target data operation approval work order is determined based on operation log data, abnormal key operation elements, and the target difference analysis report by using the framework. In this way, in view of the pain points such as disconnection between data operation approval and audit and reliance on manual complex audit, the capabilities of large models in natural language processing, anomaly detection, and automated review are integrated, the existing system is combined, a closed-loop management system is established, and the efficiency and accuracy of approval and audit are improved.
[0089] In some specific embodiments, the data operation audit device of the background database can further include:
[0090] a confidence degree generation module configured to perform confidence value checking on the key operation element to generate a corresponding target confidence degree;
[0091] a confidence degree judgment module configured to judge whether the target confidence degree is less than a preset threshold;
[0092] a first confidence degree judgment module configured to perform manual auditing operation on the key operation element if the target confidence degree is less than the preset threshold;
[0093] a second confidence degree judgment module configured to generate a target structured logic tree based on the key operation element by using a preset logic reasoning channel if the target confidence degree is not less than the preset threshold.
[0094] In some specific embodiments, the element identification module 12 can specifically include:
[0095] a graph structure creation unit configured to create an initial graph structure including preset business approval policy nodes and preset data security audit rule nodes by using Neo4j;
[0096] an initial strategy knowledge graph generation unit configured to add attribute information of the preset business approval policy nodes and the preset data security audit rule nodes in the initial graph structure, and establish mapping connection between nodes based on a preset business logic association relationship to generate an initial strategy knowledge graph;
[0097] a target strategy knowledge graph determination unit configured to verify the initial strategy knowledge graph and determine a target strategy knowledge graph according to a verification result.
[0098] In some specific embodiments, the target strategy knowledge graph determination unit can specifically include:
[0099] a node detection subunit configured to detect a strategy conflict node in the initial strategy knowledge graph by using a graph neural network;
[0100] a matrix determination subunit configured to determine a strategy conflict matrix according to a detection result obtained;
[0101] a target strategy knowledge graph determination subunit configured to perform a preset conflict arbitration operation on the strategy conflict matrix to generate a verification result of the initial strategy knowledge graph, and determine a target strategy knowledge graph according to the verification result.
[0102] In some specific embodiments, the report generation module 13 can specifically include:
[0103] The first edit distance judging unit is configured to judge whether the target edit distance exists in a first preset edit distance interval.
[0104] The first edit distance judging unit is configured to judge whether the target edit distance exists in a first preset edit distance interval.
[0105] The second edit distance judging unit is configured to judge whether the target edit distance exists in a second preset edit distance interval.
[0106] The second edit distance judging unit is configured to judge whether the target edit distance exists in a second preset edit distance interval.
[0107] The third edit distance judging unit is configured to judge whether the target edit distance exists in a third preset edit distance interval.
[0108] The third edit distance judging unit is configured to judge whether the target edit distance exists in a third preset edit distance interval.
[0109] In some specific embodiments, the preset dimensions include a time dimension, a space dimension, and a personnel dimension.
[0110] In some specific embodiments, the data operation auditing apparatus of the background database can further include:
[0111] The SQL script determining module is configured to determine a SQL script corresponding to the user end based on the operation log data, the abnormal key operation element, and the target difference analysis report.
[0112] The SQL script converting module is configured to convert the SQL script into a corresponding intermediate representation.
[0113] The target mapping table determining module is configured to determine a corresponding target mapping table according to the intermediate representation and by using a taint analysis technique to mark and trace a sensitive field propagation path.
[0114] The business intention determining module is configured to determine a business intention of the user end based on the target mapping table.
[0115] Further, the embodiments of the present application also disclose an electronic device, Figure 5 is a structural diagram of an electronic device 20 according to an exemplary embodiment, and the content in the figure cannot be considered as any limitation on the use range of the present application.
[0116] Figure 5A structural schematic diagram of an electronic device 20 is provided in the embodiments of the present application. The electronic device 20 can specifically include at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25 and a communication bus 26. The memory 22 is configured to store a computer program, and the processor 21 is configured to load and execute the computer program to implement the related steps in the data operation auditing method of the background database disclosed in any of the foregoing embodiments. In addition, the electronic device 20 in the embodiments of the present application can be specifically an electronic computer.
[0117] In the embodiments of the present application, the power supply 23 is configured to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 is capable of creating a data transmission channel between the electronic device 20 and external devices, and the communication protocol followed by the communication interface 24 can be any communication protocol applicable to the technical solution of the present application, which is not limited specifically herein; the input / output interface 25 is configured to obtain external input data or output data to the outside, and the specific interface type can be selected according to the specific application needs, which is not limited specifically herein.
[0118] In addition, the memory 22 as a carrier for resource storage can be a read-only memory, a random access memory, a magnetic disk or an optical disk, etc., and the resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage mode can be temporary storage or permanent storage.
[0119] The operating system 221 is configured to manage and control each hardware device on the electronic device 20 and the computer program 222, and can be Windows Server, Netware, Unix, Linux, etc. In addition to the computer program capable of completing the data operation auditing method of the background database executed by the electronic device 20 disclosed in any of the foregoing embodiments, the computer program 222 can further include a computer program capable of completing other specific work.
[0120] Further, the present application further discloses a computer readable storage medium for storing a computer program; wherein the computer program is executed by a processor to implement the data operation auditing method of the background database disclosed in the foregoing embodiments. For the specific steps of the method, refer to the corresponding content disclosed in the foregoing embodiments, which will not be repeated here.
[0121] The embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. For the same or similar parts between the embodiments, refer to each other. For the device disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple, and the relevant parts refer to the method part.
[0122] Those skilled in the art will further appreciate that the units and algorithm steps of the various examples described in connection with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or combinations of both. To clearly illustrate this interchangeability of hardware and software, various examples have been described herein in terms of their functionality, which has been described generally and symbolically in flow charts. Having thus described the functionality of the examples, a person of ordinary skill in the art will be able to implement such functionality in hardware and / or software, and will recognize that the bounds of the examples are not limited by one approach or the other. The various examples can be realized in a centralized fashion in one computer system or network, or in a distributed fashion where different elements are spread across several computer systems or sub-networks. Any kind of computer system or other apparatus adapted for carrying out the methods described herein is suited. A typical combination of hardware and software could be a general purpose computer system with a computer program that, when being loaded and executed, carries out the methods described herein.
[0123] The steps of a method or algorithm described in connection with the embodiments disclosed herein can be embodied directly in hardware, in a software module executed by a processor, or in a combination of the two. A software module can reside in random access memory (RAM), flash memory, read-only memory (ROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), registers, hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor such that the processor can read information from, and write information to, the storage medium. In the alternative, hard disk can be used as a storage medium.
[0124] Finally, it should be noted that the terms "first", "second", and the like, herein do not denote any order, quantity, combination, or importance, but rather are used to distinguish one element from another, and do not imply singular or plural. Moreover, the terms "include", "have", or any other variant thereof are intended to encompass non-exclusive inclusions, such that processes, methods, articles, or apparatuses that comprise a set of elements not expressly listed are also within the scope of the present application. In addition, the articles "a" and "an" are used herein to refer to one or to more than one (i.e., to one or at least one) of the grammatical object of the article. By way of example, "an element" means one element or one or more elements.
[0125] The above detailed description of the technical solutions provided by the present application has been described in detail, and the principles and implementation modes of the present application have been described in the above examples. The above example is only used to help understand the method and core idea of the present application; at the same time, for those skilled in the art, according to the idea of the present application, the specific implementation mode and application range will be changed; in view of the above, the content of the specification should not be understood as limiting the present application.
Claims
1. A method of auditing data operations of a back-end database, the method comprising: The method comprises the following steps: obtaining a target data operation approval work order, extracting key operation elements in the target data operation approval work order through a preset entity recognition channel, generating a target structured logic tree based on the key operation elements by using a preset logic reasoning channel, and converting the target structured logic tree into a target standard approval template; the target data operation approval work order is an approval work order for a target data operation on a background database; determining a target strategy knowledge graph based on a preset business approval strategy and a preset data security audit rule, and identifying an abnormal key operation element in the target data operation approval work order that meets an abnormal event condition according to the target strategy knowledge graph; obtaining a first abstract syntax tree of the target standard approval template and a second abstract syntax tree of an actual target data operation, determining a target edit distance of the first abstract syntax tree and the second abstract syntax tree, and generating a corresponding target difference analysis report based on the target edit distance; constructing an operation log audit detection framework according to a preset dimension, and determining an audit result corresponding to the target data operation approval work order based on operation log data, the abnormal key operation element and the target difference analysis report by using the operation log audit detection framework.
2. The data operation audit method of a background database according to claim 1, wherein, Further comprising: performing confidence value verification on the key operation elements to generate a corresponding target confidence; determining whether the target confidence is less than a preset threshold; if the target confidence is less than the preset threshold, performing a manual review operation on the key operation elements; if the target confidence is not less than the preset threshold, generating a target structured logic tree based on the key operation elements by using a preset logic reasoning channel.
3. The method of claim 1, wherein, The method comprises the following steps: creating an initial graph structure containing preset business approval strategy nodes and preset data security audit rule nodes by using Neo4j; adding attribute information of the preset business approval strategy nodes and the preset data security audit rule nodes in the initial graph structure, and establishing a mapping connection between the nodes based on a preset business logic association relationship to generate an initial strategy knowledge graph; verifying the initial strategy knowledge graph, and determining a target strategy knowledge graph according to the verification result.
4. The data operation audit method of a background database according to claim 3, wherein, The method comprises the following steps: detecting strategy conflict nodes in the initial strategy knowledge graph by using a graph neural network; determining a strategy conflict matrix according to the obtained detection result; performing a preset conflict arbitration operation on the strategy conflict matrix to generate a verification result of the initial strategy knowledge graph, and determining a target strategy knowledge graph according to the verification result.
5. The method of claim 1, wherein, The method comprises the following steps: determining whether the target edit distance exists in a first preset edit distance interval; if the target edit distance exists in the first preset edit distance interval, recording the actual target data operation; determining whether the target edit distance exists in a second preset edit distance interval; If the target edit distance exists in the second preset edit distance interval, the actual target data operation is suspended, and manual review is performed; It is judged whether the target edit distance exists in the third preset edit distance interval; If the target edit distance exists in the third preset edit distance interval, the actual target data operation is directly blocked.
6. The method of claim 1, wherein, The preset dimensions include time dimension, space dimension, and personnel dimension.
7. The method of claim 1, wherein, Further comprising: Based on the operation log data, the abnormal key operation elements and the target difference analysis report, the SQL script corresponding to the user end is determined; The SQL script is converted into a corresponding intermediate representation; According to the intermediate representation, the sensitive field propagation path is marked and tracked by using the taint analysis technology to determine the corresponding target mapping table; Based on the target mapping table, the business intention of the user end is determined.
8. A data operation audit apparatus of a background database, characterized by comprising: Comprising: The template conversion module is configured to obtain a target data operation approval work order, extract key operation elements in the target data operation approval work order through a preset entity recognition channel, generate a target structured logic tree based on the key operation elements by using a preset logical reasoning channel, and convert the target structured logic tree into a target standard approval template; The element recognition module is configured to determine a target strategy knowledge graph based on a preset business approval strategy and a preset data security audit rule, and identify abnormal key operation elements in the target data operation approval work order that meet abnormal event conditions according to the target strategy knowledge graph; The report generation module is configured to obtain a first abstract syntax tree of the target standard approval template and a second abstract syntax tree of an actual target data operation, determine a target edit distance between the first abstract syntax tree and the second abstract syntax tree, and generate a corresponding target difference analysis report based on the target edit distance; The audit result determination module is configured to construct an operation log audit detection framework according to a preset dimension, and determine an audit result corresponding to the target data operation approval work order based on operation log data, the abnormal key operation elements and the target difference analysis report by using the operation log audit detection framework.
9. An electronic device, comprising: Comprising: A memory for saving a computer program; A processor for executing the computer program to implement the data operation audit method of the background database according to any one of claims 1 to 7.
10. A computer-readable storage medium, characterized in that, A memory for saving a computer program; wherein the computer program is executed by a processor to implement the data operation audit method of the background database according to any one of claims 1 to 7. A memory for saving a computer program; wherein the computer program is executed by a processor to implement the data operation audit method of the background database according to any one of claims 1 to 7.