An operation and maintenance risk control method and system based on a behavior baseline, a medium and a product

Abstract

A kind of operation and maintenance risk control method, system, medium and product based on behavior baseline, it is related to the field of data processing system specially applicable to management purposes, the method comprises the following steps: collecting the read-write access frequency of each data line in production environment database, the data access hot field corresponding to each data line is constructed;Determine the target data set of data processing instruction, determine the activity weight of all data lines in the corresponding range of target data set;The activity weight of all data lines is weighted summation, and energy loss integral is calculated;Retrieve the historical operation baseline of operation and maintenance terminal, determine the energy loss threshold when operation and maintenance terminal executes delete operation in historical maintenance window;When energy loss integral exceeds energy loss threshold, risk prompt is generated and the session authority of operation and maintenance terminal is locked. By implementing the present application, it is more likely to avoid the false alarm problem of regular operation in business maintenance scenario, and the operation and maintenance efficiency is improved.

Description

Technical Field

[0001] This application relates to the field of data processing systems specifically applicable to management purposes, and more particularly to an operation and maintenance risk control method, system, medium, and product based on behavioral baselines. Background Technology

[0002] As smart park and bonded zone business systems become increasingly complex, the security of operation and maintenance has become crucial to safeguarding the core value of data assets. This is especially true in highly sensitive areas involving customs data exchange and cross-border e-commerce, where operations and maintenance personnel need to frequently perform command operations on production environment databases and servers to maintain system stability.

[0003] In related technologies, operation and maintenance risk control technology usually adopts a statistical behavior baseline analysis scheme. This scheme collects the historical operation logs of operation and maintenance personnel and uses machine learning algorithms to establish a normal behavior baseline model that includes dimensions such as operation time, operation command frequency and login IP. When the operation and maintenance operation detected in real time deviates from the statistical baseline, the system will determine it as abnormal behavior and trigger an alarm, thereby identifying the risk of account theft or illegal operation.

[0004] However, in complex business maintenance scenarios, such as when operations personnel perform legitimate cold data cleanup tasks (e.g., deleting archived logs from three years ago), tens of thousands of rows of data often need to be modified. Because tens of thousands of rows of data trigger the row count threshold in the relevant technology, such compliant operations are often mistakenly blocked by the system, leading to low operational efficiency. Summary of the Invention

[0005] This application provides an operation and maintenance risk control method, system, medium, and product based on behavioral baselines, which can avoid false alarms in routine operations during business maintenance scenarios to a greater extent and improve operation and maintenance efficiency.

[0006] Firstly, this application provides an operation and maintenance risk control method based on behavioral baselines, applied to a business management system. The method includes: collecting the read and write access frequency of each data row in the production environment database; constructing a data access heatmap with activity weights corresponding to each data row based on a time decay algorithm; listening to data processing instructions submitted by the operation and maintenance terminal to determine the target dataset of the data processing instructions; mapping the target dataset in an isolated environment based on bitmap indexing technology to determine the activity weights of all data rows within the target dataset range; weighted summing of the activity weights of all data rows to calculate the energy loss integral corresponding to the data processing instruction; this energy loss integral characterizes the degree of loss of active data value in the system after the data processing instruction is executed; retrieving the historical operation baseline of the operation and maintenance terminal to determine the energy loss threshold when the operation and maintenance terminal performs a deletion operation within the historical maintenance window; and generating a risk warning and locking the session permissions of the operation and maintenance terminal when the energy loss integral exceeds the energy loss threshold.

[0007] In the above embodiments, the business management system constructs a data access hotspot, transforming the dimension of risk assessment from the simple number of data rows to the business value of the data rows. The calculated energy loss integral can distinguish between the deletion of a large amount of low-value historical data and a small amount of high-value core data, making the risk judgment basis closer to the actual business impact. By comparing it with the historical operation baseline of the operation and maintenance personnel, personalized risk threshold control can be achieved, improving the smoothness and efficiency of operation and maintenance work.

[0008] In conjunction with some embodiments of the first aspect, in some embodiments, the step of listening to the data processing instructions submitted by the operation and maintenance terminal and determining the target dataset of the data processing instructions specifically includes: listening to the data processing instructions submitted by the operation and maintenance terminal, retrieving the metadata dictionary of the production environment database, and constructing a table association topology graph containing the target table name and foreign key constraint relationships of the data processing instructions; based on the table association topology graph, when recursively traversing downstream association tables where the target table name has cascading delete attributes, marking the downstream association tables as implicitly damaged objects; simulating association queries on implicitly damaged objects in an isolated environment to obtain association results; and merging the association results into the data row pointed to by the data processing instructions to obtain the target dataset.

[0009] In the above embodiments, the business management system can comprehensively estimate the true impact range of data processing instructions by constructing a table association topology graph and identifying hidden damaged objects. It not only analyzes the data directly operated by the instructions, but also mines potentially affected related data through the cascading attributes of foreign keys, expanding the destructive power of the instructions from a point to a surface, ensuring the integrity of the target dataset, and preventing high-risk operations from being mistakenly performed due to underestimating the chain reaction.

[0010] In conjunction with some embodiments of the first aspect, in some embodiments, the step of mapping the target dataset based on bitmap indexing technology in an isolated environment and determining the activity weight of all data rows within the corresponding range of the target dataset specifically includes: in the isolated environment, constructing a primary-foreign-key bitmap mapping index between the target table name and the downstream associated table; the primary-foreign-key bitmap mapping index represents the position of the associated row corresponding to each data row in the target table name in the downstream associated table; converting the data row pointed to by the data processing instruction into a first bitmap, and performing a projection operation through the primary-foreign-key bitmap mapping index to generate a second bitmap representing the affected rows in the implicitly damaged object; respectively counting the number of bits and data positions in the first bitmap and the second bitmap, and directly indexing the activity weight of the corresponding data position in the data access hotspot.

[0011] In the above embodiments, the business management system utilizes bitmap indexing technology to achieve efficient location and mapping of large-scale affected data rows. Compared with traditional row-by-row traversal, bitmap operation can identify directly affected and indirectly affected rows with extremely high efficiency. By directly indexing the data access hotspot through the bitmap's position, complex join queries are avoided, and the calculation delay of risk assessment is significantly shortened.

[0012] In conjunction with some embodiments of the first aspect, in some embodiments, the step of calculating the energy loss integral corresponding to the data processing instruction by weighted summation of the activity weights of all data rows specifically includes: weighted summation of the activity weights of all data rows to obtain a basic loss value; calculating a first proportion of the number of bits set in the first bitmap relative to the total number of rows in the target table name, and a second proportion of the number of bits set in the second bitmap relative to the total number of rows in the downstream associated table, and selecting the larger value between the first proportion and the second proportion as the lethality coefficient; and calculating the energy loss integral based on the basic loss value and the lethality coefficient.

[0013] In the above embodiments, the business control system introduces a lethality coefficient, which comprehensively considers the extent of damage to individual tables and related tables caused by the operation. This makes the risk assessment not only focus on the absolute value of the loss (basic loss value) but also on its relative impact scale, making the risk measurement more balanced and comprehensive, and effectively identifying operations with local destructive impact.

[0014] In conjunction with some embodiments of the first aspect, in some embodiments, the step of collecting the read and write access frequency of each data row in the production environment database and constructing a data access heat field with corresponding activity weights for each data row based on a time decay algorithm specifically includes: collecting the read and write access frequency of each data row in the production environment database, parsing the business metadata of the data table to which each data row belongs, and determining the minimum retention value level of the data table; calculating the real-time popularity of each data row based on the time decay algorithm; determining the higher value between the real-time popularity and the preset minimum retention value level as the activity weight; and constructing a data access heat field based on the activity weights of each data row.

[0015] In the above embodiments, the business management system combines real-time popularity with the minimum retention value level to ensure the accuracy and robustness of the activity weight assessment, avoids erroneously underestimating the value of key static data due to low access frequency, and enables the data access heat field to more realistically reflect the value distribution of the entire system.

[0016] In conjunction with some embodiments of the first aspect, in some embodiments, after generating a risk warning and locking the session permissions of the operation and maintenance terminal when the energy loss integral exceeds the energy loss threshold, the method further includes: in response to the received senior administrator authorization instruction corresponding to the risk warning, unlocking the session permissions and allowing the data processing instruction, and marking the data processing instruction as a special compliance sample; and performing baseline drift correction on the historical operation baseline of the operation and maintenance terminal based on the actual energy loss integral generated by the data processing instruction.

[0017] In the above embodiments, the business control system learns from the authorized operations as special compliance samples and corrects the historical operation baseline accordingly, so that the risk control model has the ability to continuously learn and evolve, adapt to changes in business development and operation and maintenance mode, and gradually reduce false alarms for similar compliant operations.

[0018] In conjunction with some embodiments of the first aspect, in some embodiments, the step of performing baseline drift correction on the historical operating baseline of the operation and maintenance terminal based on the actual energy loss integral generated by the data processing instructions specifically includes: calculating the overflow difference between the actual energy loss integral and the energy loss threshold; performing weighted smoothing processing on the overflow difference based on a preset trust growth factor to obtain a baseline compensation value; accumulating the baseline compensation value into the historical operating baseline to generate an updated energy loss threshold; and synchronizing the updated energy loss threshold to the configuration center of the business management system.

[0019] In the above embodiments, the business management system uses a weighted smoothing process to correct baseline drift, ensuring the stability and gradualness of baseline adjustment. The updated threshold is synchronized to the configuration center, ensuring the consistency of the entire distributed risk control system and making the adaptive learning of the baseline safe and controllable.

[0020] In a second aspect, embodiments of this application provide a business management system, which includes: one or more processors and a memory; the memory is coupled to the one or more processors, and the memory is used to store computer program code, the computer program code including computer instructions, and the one or more processors call the computer instructions to cause the business management system to perform the method described in the first aspect and any possible implementation thereof.

[0021] Thirdly, embodiments of this application provide a computer-readable storage medium including instructions that, when executed on a business management system, cause the business management system to perform the method described in the first aspect and any possible implementation thereof.

[0022] Fourthly, embodiments of this application provide a computer program product containing instructions that, when the computer program product is run on a business management system, cause the business management system to execute the method described in the first aspect and any possible implementation thereof.

[0023] Understandably, the business management system provided in the second aspect, the computer storage medium provided in the third aspect, and the computer program product provided in the fourth aspect are all used to execute the methods provided in the embodiments of this application. Therefore, the beneficial effects they can achieve can be referred to the beneficial effects in the corresponding methods, and will not be repeated here.

[0024] One or more technical solutions provided in the embodiments of this application have at least the following technical effects or advantages:

[0025] 1. By adopting a technical solution that constructs a data access heat field based on read / write frequency and time decay algorithms, and uses energy loss integral to characterize the degree of data value loss, the business management system can assess operational risks from the perspective of business value rather than data volume. This effectively solves the problem in existing technologies where compliance operations such as cleaning up low-value historical data are misjudged as risky behaviors due to simply relying on row number thresholds. As a result, it achieves accurate identification of operational risks and improves operational efficiency.

[0026] 2. By adopting a technical solution of constructing a table association topology graph and recursively traversing and deleting attributes to identify hidden damaged objects, the business control system can comprehensively determine the complete impact range of data processing instructions. This effectively solves the problem in existing technologies that only analyze the direct target of instructions while ignoring chain reactions, resulting in incomplete and inaccurate risk assessments. As a result, it achieves in-depth prediction of the potential destructiveness of operations and enhances the rigor of risk control.

[0027] 3. By adopting a technical solution that builds a primary-foreign key bitmap mapping index in an isolated environment and quickly locates all affected data rows through bitmap projection operations, the business management system can efficiently complete the association impact analysis of large-scale datasets. This effectively solves the problem of low performance when simulating execution or traversing association queries row by row in existing technologies, thereby realizing real-time risk assessment of complex deletion commands and ensuring the immediacy of risk control decisions. Attached Figure Description

[0028] Figure 1 This is a flowchart illustrating the operation and maintenance risk control method based on behavioral baselines in this application embodiment;

[0029] Figure 2 This is another flowchart illustrating the operation and maintenance risk control method based on behavioral baselines in this application embodiment;

[0030] Figure 3This is a schematic diagram of the physical device structure of the business control system in the embodiments of this application. Detailed Implementation

[0031] The terminology used in the following embodiments of this application is for the purpose of describing particular embodiments only and is not intended to be limiting of this application. As used in the specification of this application, the singular expressions “a,” “an,” “the,” “the,” and “this” are intended to include the plural expressions as well, unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used in this application refers to any or all possible combinations including one or more of the listed items.

[0032] Hereinafter, the terms "first" and "second" are used for descriptive purposes only and should not be construed as implying or suggesting relative importance or implicitly indicating the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature, and in the description of the embodiments of this application, unless otherwise stated, "multiple" means two or more.

[0033] In the specific implementation scenario of this application, such as a smart park business system handling customs data exchange and cross-border e-commerce, each technical term has a clear business meaning. The production environment database refers to a real-time database storing core business data such as customs declarations, commodity inventory, cross-border orders, and logistics status of enterprises within the park. The operation and maintenance terminal is a computer used by technicians to perform database maintenance tasks (e.g., cleaning up expired customs declaration records and archiving completed order data). The data access hotspot is a dynamic, logical data value map that assigns an activity weight to each row of data in the database (such as a specific order record); orders that have been frequently queried or modified recently have a higher weight, while archived logistics information from three years ago has a very low weight. The energy loss score is a quantitative indicator of the business value loss caused by a single deletion operation; deleting 100 pending customs clearance order records will generate an extremely high energy loss score, while deleting 10,000 system operation logs from five years ago will result in a very low score.

[0034] Historical operational baselines and energy consumption thresholds are personalized risk control standards established for specific operations and maintenance personnel. For example, operations and maintenance personnel responsible for data archiving may have a relatively high energy consumption threshold due to their baseline involving the periodic large-scale deletion of low-value data. Hidden damaged objects refer to data affected by the database's cascading deletion rules. For instance, if the product information associated with a supplier is set to cascade delete when a supplier's information is deleted, then that product information is a hidden damaged object.

[0035] The following describes the process of the method provided in this implementation. Please refer to [link / reference]. Figure 1This is a flowchart illustrating an operation and maintenance risk control method based on behavioral baselines in an embodiment of this application.

[0036] S101. Collect the read and write access frequency of each data row in the production environment database, and construct a data access heat field with corresponding activity weights for each data row based on the time decay algorithm.

[0037] Among them, the production environment database refers to the database instance that carries online business; read and write access frequency represents the number of times a data row is executed by SELECT, INSERT, UPDATE, and DELETE operations per unit time; the time decay algorithm is an algorithm used to reduce the impact of historical access frequency, ensuring that the weight mainly reflects the recent data activity; the activity weight is a value that quantifies the current importance of a data row; the data access heatmap is a data structure that stores all data rows and their corresponding activity weights, which can be regarded as a value distribution map of the entire database.

[0038] Specifically, the business control system continuously acquires read and write operation records for each data row by subscribing to the logs of the production environment database (such as MySQL's Binlog or PostgreSQL's logical replication stream) or using a database auditing plugin. For each access, the system increments the access count value of the corresponding data row. Simultaneously, the system periodically applies an exponential decay function, for example, new weight = old weight * e^(-λ * Δt), where λ is the decay constant and Δt is the time interval. This process causes the weight of data rows that have not been accessed recently to naturally decrease over time. The final constructed data access heatmap can be an in-memory hash table or an external key-value store (such as Redis), using the unique identifier of the data row (such as the primary key) as the key and the activity weight as the value.

[0039] In some embodiments, the construction of data access heatmaps can be implemented in several ways: Optionally, a separate log analysis service can be deployed, which consumes database log streams, calculates the heat of each data row in real time, and writes the results to a dedicated heat database. The risk control module queries this database to obtain the weights. Optionally, a trigger can be created at the database level. After each data row is read or written, the trigger directly calls a stored procedure to update a heat statistics table associated with the business table. It is understood that other methods can also be used to collect and calculate data heat, such as recording data access through application layer code embedding, which is not limited here.

[0040] In some embodiments, a cold start problem may occur, where newly launched systems or newly added data tables have data rows with an initial activity weight of zero due to a lack of historical access records. This may result in the inability to effectively identify risks when high-value new data is deleted. To address this, the business management system incorporates a preset initial potential value when calculating activity weights. This value is set based on the metadata of the data table or data row (such as the importance of the business module to which it belongs), ensuring that any new data has a basic value score before accumulating sufficient access history.

[0041] S12. Listen for data processing instructions submitted by the operation and maintenance terminal and determine the target dataset of the data processing instructions.

[0042] In this context, the operation and maintenance terminal refers to the client or bastion host used by operation and maintenance personnel to perform database operations; data processing instructions usually refer to SQL statements, especially destructive statements such as DELETE or UPDATE; the target dataset refers to the set of all data rows that will be removed or modified from the database if the instruction is executed. This set includes not only the rows directly specified by the instruction, but also the rows affected by cascading relationships.

[0043] Specifically, the business control system acts as a proxy layer for database access, or by deploying an agent program on a bastion host, to capture all SQL commands sent from the operations and maintenance terminal to the production environment database in real time. When a data deletion command such as DELETE or TRUNCATE is detected, the system intercepts the command and does not execute it. Subsequently, the system parses the text of the SQL command to extract key information such as the target table name and WHERE clause. The initial target dataset consists of rows that meet the WHERE condition, but the dataset is incomplete at this point and needs to be supplemented with the cascading effects in subsequent steps.

[0044] In some embodiments, command interception and parsing can be achieved in several ways: Optionally, a database proxy solution, such as MyCat or ProxySQL, can be used, with risk control logic developed within its plugin mechanism, allowing all SQL statements passing through the proxy to be analyzed; alternatively, network traffic mirroring technology can be used to copy the traffic of the database server port to the risk control analysis engine, which then reconstructs and analyzes the SQL commands from the network packets. It is understood that other methods can also be used to capture commands, such as using operating system-level eBPF technology for system call tracing, which is not limited here.

[0045] S103. In an isolated environment, map the target dataset based on bitmap indexing technology and determine the activity weight of all data rows within the corresponding range of the target dataset.

[0046] Among them, an isolated environment refers to a computing space isolated from the production environment, used for secure risk simulation analysis; bitmap indexing technology is an efficient data indexing method that uses a bit to represent whether a row of data has a certain attribute; mapping the target dataset refers to identifying the physical or logical location of each row of data in the target dataset in the database table.

[0047] Specifically, the business control system first creates temporary bitmap indexes for the target dataset (containing rows directly and indirectly affected) in the isolated environment, based on the target dataset determined in step S102. For example, for a table with 100 million rows, a bitmap is a sequence of 100 million bits. If an instruction affects rows 1, 100, and 1000, then bits 1, 100, and 1000 of that bitmap will be set to 1. By performing logical operations on these bitmaps (such as OR operations to merge multiple sources of influence), a final overall bitmap representing all affected rows can be obtained. Then, the system traverses this overall bitmap; for each bit set to 1, its position corresponds to a row of affected data. The system uses this position information to directly index and obtain the activity weight of that data row in the data access hotspot constructed in step S101.

[0048] In some embodiments, inconsistencies may arise between the data access hotspot and the production database regarding data row locations. For example, the hotspot may use logical row numbers, which may change after physical database reorganization. To address this, the business management system, when constructing the data access hotspot, avoids using volatile physical or logical row numbers as keys. Instead, it uniformly uses the primary key of each data row as a unique identifier. This ensures that the primary key remains unchanged regardless of how data is stored and moved on disk, guaranteeing that the data row located from the bitmap index can accurately find its corresponding activity weight within the hotspot.

[0049] S104. Calculate the energy loss integral corresponding to the data processing instruction by summing the activity weights of all data rows.

[0050] Among them, weighted summation refers to summing up the activity weights of each affected data row; energy loss score is a comprehensive risk score that not only considers the sum of activity weights, but may also introduce other risk factors.

[0051] Specifically, after obtaining the activity weight list of all affected data rows in step S103, the business control system performs a simple summation operation to obtain a basic loss value. This value intuitively reflects the total active value carried by the deleted data. In some complex implementations, this step may also consider other factors, such as introducing a lethality coefficient, which reflects the extent of damage to the table caused by the deletion operation. The final energy loss integral may be the product of the basic loss value and the lethality coefficient, or calculated through other more complex formulas to more comprehensively quantify the risk.

[0052] In some embodiments, the energy loss integral can be calculated in several ways: Optionally, a simple linear summation can be used, integral = Σ(activity weight); alternatively, a nonlinear model can be introduced, for example, assigning a higher quadratic or exponential gain to the parts with higher weights, i.e., integral = Σ(activity weight^k), where k>1, thereby amplifying the sensitivity to operations on high-value data. It is understood that a machine learning model can also be used to calculate the integral, taking into input multi-dimensional features such as the weights, quantities, and importance of the tables to which all affected rows belong, and outputting a risk score; this is not limited here.

[0053] In some embodiments, the activity weighting metrics for different data tables may differ. For example, the weight range for the order table might be [100, 1000], while the weight range for the log table might be [1, 10]. Direct summation could lead to risk assessment bias towards the table with the larger weight range. To address this, the business control system normalizes the activity weights of each data row before calculation. Normalization can be performed at the table level, converting each weight into its relative position within the table's maximum and minimum weights, ensuring that all weight values ​​fall within a uniform range (e.g., [0, 1]), thereby achieving fair comparison and summation across tables.

[0054] S105. Retrieve the historical operation baseline of the operation and maintenance terminal to determine the energy consumption threshold when the operation and maintenance terminal performs a deletion operation within the historical maintenance window.

[0055] Among them, the historical operation baseline is a behavioral profile established for each operation and maintenance personnel or role, which records the typical parameters of various operations performed by them in the past period (historical maintenance window); the energy loss threshold is the maximum energy loss integral that the personnel can accept, calculated based on the baseline.

[0056] Specifically, the business control system maintains a baseline database. Whenever an operational operation is approved, the system records the operator, the operation type (delete, update, etc.), and the calculated energy loss integral for that operation. For a specific operations personnel, the system analyzes the energy loss integral distribution of all deletion operations they have performed within a specific time period (e.g., the last 90 days). The energy loss threshold can be calculated based on this distribution, for example, by taking the 95th percentile or the mean plus three standard deviations. This means that as long as the energy loss integral of a new operation does not exceed 95% of the operations performed by that operations personnel in their history, it is considered routine behavior.

[0057] In some embodiments, thresholds can be determined in several ways: Optionally, a combination of static thresholds and dynamic baselines can be used, where each role has a base threshold, which is then fine-tuned based on individual behavior; alternatively, a time factor can be introduced, for example, operations performed outside of working hours (such as late at night) will have their corresponding thresholds lowered to increase risk sensitivity. It is understood that more complex clustering algorithms (such as K-Means) can also be used to group operations personnel, with personnel within the same group sharing similar baselines and thresholds; this is not limited here.

[0058] In some embodiments, there may be situations where changes in the roles of operations and maintenance personnel or the onboarding of new employees result in historical baselines becoming inapplicable or non-existent. To address this, the business management system supports role-based baseline inheritance. New employees are assigned a role (such as a junior DBA or data archiving engineer) and inherit the average historical operating baseline and energy consumption threshold for that role. For employees whose roles change, the system can provide a baseline reset option, or, for a period of time after the role change, weightedly merge their personal baseline with the new role baseline to achieve a smooth transition.

[0059] S106. When the energy loss integral exceeds the energy loss threshold, generate a risk warning and lock the session permissions of the operation and maintenance terminal.

[0060] Risk alerts are warning messages sent to the administrator or operations personnel themselves; locking session permissions means temporarily suspending the ability of the operations terminal session to perform any database write operations, but usually retaining read operation permissions to troubleshoot problems.

[0061] Specifically, the business control system compares the energy consumption score of the current operation calculated in step S104 with the energy consumption threshold for the maintenance personnel determined in step S105. If the score is greater than the threshold, the system determines that the operation is a high-risk abnormal behavior. At this time, the system will immediately perform two actions: First, it will send a detailed risk warning to the security administrator or maintenance supervisor through a preset channel (such as WeChat, DingTalk, SMS, or email), which includes the operator, source IP, SQL command to be executed, calculated energy consumption score, and the exceeded threshold; Second, it will issue an instruction to the database agent or bastion host to lock or read-only the current database session state of the maintenance terminal, so that any subsequent write operations submitted by it will be rejected.

[0062] In some embodiments, risk management can be implemented in several ways: Optionally, a multi-level alarm mechanism can be adopted, for example, exceeding a threshold of 120% triggers a Level 1 alarm and locks the session, while exceeding 100% but below 120% triggers a Level 2 alarm, only prompting an alert without locking the session; Optionally, interactive confirmation can be provided, requiring the operator to provide a reason for performing this action in a pop-up window on the maintenance terminal while locking the session, and this reason will serve as the basis for subsequent auditing. It is understood that other security devices can also be linked, such as adding the source IP to a temporary watchlist or triggering more detailed session recording; this is not limited here.

[0063] In some embodiments, there may be emergency fault handling scenarios where any disruption could exacerbate the problem. To address this, the business management system provides an emergency mode or emergency channel. Highly authorized operations personnel can declare entry into emergency mode upon login. In this mode, the risk control logic still calculates energy loss integrals and generates audit logs and alarms, but it does not perform locking operations; instead, decision-making power is entirely delegated to on-site operations personnel. All operations performed in emergency mode are highlighted and rigorously reviewed and audited afterward.

[0064] The following provides a more detailed description of the process of the method provided in this implementation. Please refer to [link / reference]. Figure 2 This is another flowchart illustrating the operation and maintenance risk control method based on behavioral baselines in this application embodiment.

[0065] S201. Collect the read and write access frequency of each data row in the production environment database, and construct a data access heat field with corresponding activity weights for each data row based on the time decay algorithm.

[0066] Refer to step S101, which will not be repeated here.

[0067] In some embodiments, when constructing a data access hotspot, the business management system, to ensure the accuracy of data value assessment, comprehensively considers the dynamic access frequency and static business value of the data. Specifically, the business management system collects the read and write access frequency of each data row in the production environment database, parses the business metadata of the data table to which each data row belongs, and determines the minimum retention value level of the data table; calculates the real-time popularity of each data row based on a time decay algorithm; determines the higher of the preset minimum retention score corresponding to the real-time popularity and the minimum retention value level as the activity weight; and constructs a data access hotspot based on the activity weight of each data row.

[0068] Among them, business metadata refers to information describing the business attributes of data, such as the business domain to which the data belongs and the security level; the minimum retained value level is a table-level static value score predefined by the data governance strategy, used to represent the inherent importance of the data in the table; real-time popularity is a dynamic score calculated by a time decay algorithm that reflects the current access activity of the data; and the preset minimum value is a value corresponding to the minimum retained value level.

[0069] Specifically, the business management system performs a two-stage process when calculating the final activity weight for each row of data. In the first stage, as described in step S101, the real-time popularity of each row is calculated by analyzing database logs and applying a time decay algorithm. In the second stage, the system queries a pre-configured metadata knowledge base to obtain the minimum retention value level of the data table to which the row belongs (e.g., divided into four levels: P0, P1, P2, and P3). Each level corresponds to a preset minimum score (e.g., P0 corresponds to 10,000 points, and P1 corresponds to 5,000 points). Then, the system compares the real-time popularity of the row with the preset minimum score of its table, taking the larger of the two as the final activity weight for that data row. For example, a configuration item in the `system_config` table has a minimum retention value level of P0 (minimum 10,000 points). Even if it is only read once a year, its real-time popularity may only be 5, but its final activity weight will be determined as max(5, 10,000) = 10,000. Conversely, a session record in the user_session table with a level of P3 (minimum 10 points) but a real-time popularity of 800 due to frequent access will have a final weight of max(800, 10) = 800.

[0070] In some embodiments, this step can be implemented in several ways. Optionally, the assessment of the minimum retained value level can be linked to the enterprise's data asset catalog or CMDB (Configuration Management Database) system to achieve centralized management. When the business attributes of a data table change in the CMDB, its value level is updated. Optionally, in addition to taking the larger value, a weighted combination method can also be used, such as activity weight = α * real-time popularity + (1-α) * minimum score, where α is an adjustable weighting factor used to balance the importance of dynamic popularity and static value. It is understood that the purpose of this mechanism is to ensure that the value assessment of any data row has a safe lower limit, preventing critical but infrequently accessed data from being incorrectly judged as low value; this is not limited here.

[0071] In some embodiments, business development may lead to changes in the importance of a data table, but the minimum retained value level in the metadata may not be updated in a timely manner. To address this, the business management system can introduce a value drift monitoring module. This module periodically analyzes the overall distribution and trend of the real-time popularity of each data table. If a table previously rated as low-value experiences a sustained and abnormally high average real-time popularity over a period of time, the system can generate a work order suggesting a value level reassessment, reminding the data administrator to review and update the table's minimum retained value level.

[0072] S202. Listen for data processing instructions submitted by the operation and maintenance terminal, retrieve the metadata dictionary of the production environment database, and construct a table association topology diagram containing the target table names and foreign key constraints of the data processing instructions.

[0073] Among them, the metadata dictionary is a collection of system tables in the database that store information about the database structure, such as information_schema; the target table name refers to the table specified by the FROM clause in the data processing instruction; foreign key constraints define the referential integrity between tables; and the table association topology graph is a directed graph with data tables as nodes and foreign key constraints as edges.

[0074] Specifically, after detecting a data processing instruction, the business control system first parses out the target table name A. Then, the system queries the database's metadata dictionary to obtain all foreign key constraints associated with table A. These constraints specify which columns in which tables reference columns in table A, or which columns in table A reference columns in other tables. Based on this information, the system constructs a graph structure in memory, where each table is a node, each foreign key relationship is a directed edge, and the edge's attributes indicate the constraint type.

[0075] In some embodiments, the topology graph can be constructed in several ways: Optionally, the system loads all database metadata once at startup, constructs a complete topology graph and caches it, and then incrementally updates the graph only when the database structure changes (DDL operations); Optionally, a lazy loading method is used, where the relevant local topology graph is queried and constructed only as needed, starting from the target table of the instruction, when analyzing a specific instruction. It is understood that the topology graph can also be persistently stored to speed up subsequent analysis, but this is not limited here.

[0076] In some embodiments, logical relationships may exist across databases or microservices that are not defined using database foreign keys. To address this, the business management system provides a manual configuration interface. Architects or developers can use this interface to manually define these implicit logical relationships. When building the topology map, the system merges these manually configured relationships with the physical relationships discovered from the metadata dictionary, resulting in a more complete and accurate business data relationship topology map.

[0077] S203. Based on the table association topology graph, when recursively traversing downstream association tables with cascading delete attributes for the target table name, mark the downstream association tables as implicitly damaged objects.

[0078] Among them, recursive traversal is an algorithm used to access all nodes in a graph or tree structure; cascading delete attribute refers to the ON DELETE CASCADE behavior defined in foreign key constraints; downstream related tables refer to tables in the topology graph that are directly or indirectly referenced by the target table through foreign key relationships; latently damaged objects refer to those tables that, although not appearing in the original instructions, will undergo data changes due to cascading effects.

[0079] Specifically, the business control system uses the target table parsed in step S202 as the starting point and performs graph traversal (such as depth-first search or breadth-first search) on the constructed table relationship topology graph. During the traversal, when moving from table A to table B along an edge, and the foreign key constraint represented by that edge has the ON DELETE CASCADE attribute, the system marks table B as a implicitly damaged object. If table B itself has a cascading delete foreign key pointing to table C, the traversal continues, and table C is also marked. This process continues until all downstream tables accessible through the cascading delete path have been marked.

[0080] In some embodiments, the identification of latently damaged objects can be achieved in several ways: Optionally, the topology graph can be preprocessed before traversal to mark all loops, thus avoiding getting stuck in infinite loops during traversal; Optionally, in addition to CASCADE, analysis of other constraint types can be configured. Although these do not delete rows, they modify the data and can also be considered a form of damage. It is understood that the choice of traversal algorithm can be optimized according to the characteristics of the topology graph. For example, for graphs with obvious hierarchical structures, depth-first search is more efficient, but this is not limited here.

[0081] In some embodiments, excessively deep cascading deletions can lead to excessively long traversal times, impacting real-time performance. To address this, the business management system can set a maximum traversal depth. When the recursive traversal depth exceeds this preset threshold (e.g., 5 levels), the system will stop tracing downwards, mark the end node of the current traversal path as a potential deep-level impact, and generate a specific alarm message, alerting the administrator to potential unexplored deep cascading risks and recommending manual verification.

[0082] S204. Simulate association queries on implicitly damaged objects in an isolated environment to obtain association results.

[0083] Among them, simulated association query refers to performing a query operation without actually modifying the data to determine which rows will be affected; the association result refers to the set of specific data rows that are associated with the data rows that the original instruction was to delete in the implicitly damaged object.

[0084] Specifically, the business control system has identified the data rows in the target table to be deleted by the original instruction (e.g., through the primary key list {pk1, pk2, ...}). For each implicitly damaged object table marked in step S203 (e.g., table B), the system constructs and executes a query similar to SELECT * FROM B WHERE B.foreign_key IN {pk1, pk2, ...} in an isolated environment. The purpose of this query is to find all rows in table B that reference data from table A, which is about to be deleted. The system performs a similar operation on all implicitly damaged objects, collecting the results returned by all queries.

[0085] In some embodiments, the retrieval of association results can be achieved in several ways: Optionally, if the data volume is huge, to avoid transmitting the entire data row, the query can only return a list of primary keys of the affected rows to reduce network overhead and memory usage; alternatively, materialized views or pre-computed association indexes can be used to accelerate frequently queried associations instead of performing real-time queries every time. It is understood that the implementation of an isolation environment can also vary, including database snapshots, a read-only copy, or a separate sandbox database kept updated through data synchronization tools; no specific method is limited here.

[0086] In some embodiments, polymorphic associations exist, where a foreign key may point to multiple different parent tables, and the target of a join query cannot be determined solely by the foreign key constraint. To address this, the business control system identifies this pattern when parsing metadata (typically through the `foreign_key` and `foreign_type` fields). When simulating a join query, the system dynamically populates the `foreign_type` query conditions based on the target table name of the original instruction, ensuring that the join query accurately hits the correct implicitly corrupted data.

[0087] S205. Merge the association results into the data row pointed to by the data processing instruction to obtain the target dataset.

[0088] Here, merging refers to combining multiple datasets into one; the data rows pointed to by the data processing instruction are the rows directly matched by the WHERE clause of the instruction; the target dataset is the final, complete list of all data rows that will be affected by this operation.

[0089] Specifically, the business control system merges two parts of data: one part is the set of data rows initially determined in step S202, directly pointed to by the data processing instruction; the other part is the set of correlation results queried from all latently damaged objects in step S204. This merged set is the final target dataset. This dataset completely represents the entire set of all data rows that will be changed (deleted or modified) in the database after the execution of the data processing instruction. This complete dataset is the basis for subsequent accurate energy loss assessment.

[0090] In some embodiments, the merge operation can be implemented in several ways: Optionally, the unique identifiers (such as table name + primary key) of all affected rows can be stored in a hash set to naturally complete the merge using its deduplication properties; alternatively, if subsequent processing requires distinguishing between direct and indirect impacts, a structured list containing row identifiers and impact types (direct / indirect) can be constructed. It is understood that this step is a logical merge, focusing on forming a unified list of rows to be analyzed; physically, data movement is not necessarily required, and this is not a limitation here.

[0091] In some embodiments, cascading deletions at different levels can lead to the same row being identified multiple times. For example, A->B, A->C, B->D, C->D. When A is deleted, a row in D may be associated with it through both paths B and C. To address this, the business control system processes duplicates in its data structure (such as the aforementioned hash set) when merging the association results, ensuring that each row in the target dataset appears only once. This guarantees that the risk will not be exaggerated due to duplicate calculations when subsequently calculating the energy loss integral.

[0092] S206. In an isolated environment, construct a primary-foreign key bitmap mapping index between the target table name and downstream related tables.

[0093] Among them, the primary-foreign key bitmap index is a special data structure that can quickly answer the question of which rows in the associated child tables correspond to a given row in the primary table. It uses a bitmap to represent this correspondence.

[0094] Specifically, the business control system constructs a bitmap-mapped index in an isolated environment for the target table (main table) and each downstream related table (sub-table). For example, main table A has M rows, and sub-table B has N rows. This index can be an array containing M bitmaps, each of length N. The i-th bitmap in the array represents the relationship between the i-th row of data in main table A and the sub-table B. If the j-th row of data in sub-table B references the i-th row of main table A, then the j-th bit of the i-th bitmap is set to 1. By pre-constructing such an index, subsequent join queries can be transformed into efficient bitmap operations.

[0095] In some embodiments, there may be cases where the primary and foreign keys are not integers and cannot be directly used as bitmap position indexes. To address this, the business management system first constructs a temporary dictionary mapping for the primary and foreign key columns of the tables involved in the association before building the bitmap index. This dictionary maps each unique key value (such as a UUID or string) to a consecutive integer starting from 0. All subsequent bitmap operations are performed based on these integer indexes, thus resolving the issue of non-integer keys.

[0096] S207. Convert the data row pointed to by the data processing instruction into a first bitmap, and perform projection operation through the primary foreign key bitmap mapping index to generate a second bitmap representing the affected rows in the latently damaged object.

[0097] The first bitmap represents the position of the data rows directly affected by the instruction in the target table; the projection operation here refers to calculating the affected rows in the downstream table based on the first bitmap and the bitmap mapping index; the second bitmap represents the position of the data rows affected by the cascading in the downstream associated table.

[0098] Specifically, the business control system first creates a bitmap with a length equal to the total number of rows in the target table; this is the first bitmap. Then, for each row directly affected by the instruction, its position (row number or integer ID) in the table is set to 1 in the first bitmap. Next, for each downstream associated table, the system retrieves the bitmap mapping index constructed in step S206. The projection operation is as follows: iterate through all positions i set to 1 in the first bitmap, retrieve the i-th bitmap from the bitmap mapping index, and then perform a logical OR operation on all these retrieved bitmaps. The final result of the OR operation is a new bitmap, the second bitmap. The positions set to 1 in the second bitmap precisely represent all the data rows affected by the cascading in the downstream table.

[0099] In some embodiments, the projection operation can be implemented in several ways: Optionally, the SIMD (Single Instruction Multiple Data) instruction set can be used to accelerate the bitmap OR operation, significantly improving computational performance; alternatively, for sparse first bitmaps (i.e., few rows affected), a full bitmap OR operation can be avoided, and instead, a few corresponding bitmaps can be extracted and merged based on the position of the set bits, resulting in higher efficiency. It is understood that this projection operation can be executed in parallel, simultaneously calculating the second bitmap for different downstream association tables; this is not limited here.

[0100] In some embodiments, a downstream table may be cascaded and deleted from multiple upstream tables. To address this, the business control system generates multiple second bitmaps for the downstream table (one for each upstream source), and then performs an OR operation on these second bitmaps to obtain a final affected row bitmap that incorporates all impact sources. This ensures that no matter how complex the cascading path, the impact on the downstream table can be calculated completely and without redundancy.

[0101] S208. Count the number of positions and data positions in the first and second bitmaps respectively, and directly index the activity weight of the corresponding data positions in the data access hotspot.

[0102] Here, the number of bits set refers to the number of bits with a value of 1 in the bitmap, which is also the number of data rows affected; the data position refers to the index number of the bit with a value of 1 in the bitmap, which corresponds to the position of the data row.

[0103] Specifically, the business control system performs two operations on the first bitmap and all second bitmaps generated in step S207: First, it calculates the cardinality, i.e., counts the number of 1s, which quickly determines the number of rows directly and indirectly affected. Second, it traverses the bitmaps to obtain the position indices of all bits with a value of 1. For each position index, the system converts it into a unique identifier for the corresponding data row (such as a primary key, implemented through the reverse dictionary mapping in step S206), and then uses this identifier as a key to query the activity weight of that data row in the data access hotspot constructed in step S201. The system collects all the retrieved activity weights for the next step of integral calculation.

[0104] In some embodiments, weighted indexing can be implemented in several ways: Optionally, all row identifiers requiring querying can be sent to the thermal field service in batches for a single batch query to reduce the number of network communications; alternatively, if the thermal field data structure allows, the bitmap can be directly used as a query parameter, with the thermal field service internally performing decoding and weight aggregation to further improve efficiency. It is understood that bitmap libraries typically provide efficient iterators to traverse and set bits without scanning the entire bitmap; this is not a limitation here.

[0105] In some embodiments, there may be situations where a data row weight cannot be found in the data access hotspot (e.g., the row was recently inserted, and there is a delay in the hotspot update). In response, the business control system will employ a default value or a fallback strategy. For example, if the row-level weight cannot be found, the system will query the average weight of the data table to which the row belongs or the preset minimum retention value score as its activity weight. This ensures that even if the hotspot data is not fully synchronized, the risk assessment process can still continue and provide a reasonable estimate.

[0106] S209. Calculate the weighted sum of the activity weights of all data rows to obtain the basic loss value.

[0107] The base loss value is the sum of the activity weights of all affected data rows (including direct and indirect ones), representing the original total amount of data value loss caused by the operation.

[0108] Specifically, the business control system collects all activity weight values ​​belonging to the first bitmap and all second bitmaps obtained from the data access heatmap in step S208 into a list. Then, the system performs a summation operation on all values ​​in this list. This sum is the base loss value. For example, if a deletion operation affects 3 rows of data with activity weights of 100, 200, and 50 respectively, then the base loss value is 100 + 200 + 50 = 350. This value is one of the core inputs for subsequently calculating the final energy loss integral.

[0109] In some embodiments, summation can be implemented in several ways: Optionally, on a multi-core processor, the weight list can be segmented, and the partial sums of each segment can be calculated in parallel before summing, thus accelerating the calculation of a large number of data rows; alternatively, in a streaming processing architecture, each weight value can be accumulated into an accumulator after it is obtained, instead of collecting all values ​​first and then summing. Understandably, the calculation logic of this step is relatively simple; the key is to ensure that the weights of all affected rows are included in the sum without omission or duplication, which is not limited here.

[0110] In some embodiments, the definition of data value may differ across business scenarios; for example, the value of financial data and log data are not comparable. To address this, the business control system can introduce a table-level weighting factor when summing. That is, when accumulating the activity weight of a data row, it is first multiplied by the business importance coefficient of its corresponding data table. For example, the importance coefficient for a financial table is 10, while for a log table it is 0.1. Thus, the base loss value = Σ(row activity weight * table importance coefficient), allowing the calculation result to more accurately reflect the true business impact.

[0111] S210. Calculate the first ratio of the number of bits set in the first bitmap to the total number of rows in the target table name, and the second ratio of the number of bits set in the second bitmap to the total number of rows in the downstream associated table. Select the larger value between the first ratio and the second ratio as the lethality coefficient.

[0112] The first ratio represents the breadth of deletion of the target table by the instruction; the second ratio represents the breadth of deletion of the downstream related tables by the instruction; and the lethality coefficient is a risk factor used to amplify the impact of the scale of operational disruption.

[0113] Specifically, the business control system performs the following calculations: First, it obtains the number of bits set in the first bitmap (base) and divides it by the total number of rows in the target table to obtain the first ratio. Then, for each downstream related table and its corresponding second bitmap, it divides the number of bits set in the second bitmap by the total number of rows in that downstream table to obtain a second ratio. The system calculates the second ratio for all downstream tables. Finally, the system selects the largest value from the first ratio and all calculated second ratios as the lethality coefficient for this operation. For example, if 1% of the data in the target table is deleted, but 90% of the data in a crucial related table is also deleted in a cascading manner, the lethality coefficient will be 0.9.

[0114] In some embodiments, the lethality coefficient can be calculated in several ways: Optionally, instead of taking the maximum value, a weighted average of all proportions can be used, with the weights determined by the business importance of each table; alternatively, a non-linear mapping function can be defined to map the proportion values ​​to the lethality coefficient, for example, the coefficient increases rapidly when the proportion exceeds 50% to highlight the severity of clearing half a table. It is understood that the total number of rows can be cached from the database metadata, eliminating the need for real-time queries each time; this is not a limitation here.

[0115] In some embodiments, operations may be performed on partitioned tables, and calculating the proportion of total rows may not accurately reflect the impact. For example, deleting an old, unused partition, despite having many rows, may have no impact on business operations. To address this, the business management system can incorporate partition-aware logic when calculating the proportion. The system will determine whether the operation targets a specific partition. If so, the lethality coefficient can be calculated based on the proportion of rows within that partition, or an extremely low risk weight can be applied to operations on archived partitions, making their lethality coefficient close to zero.

[0116] S211. Calculate the energy loss integral based on the basic loss value and the lethality coefficient.

[0117] Among them, the energy loss integral is the final value used for risk assessment, which combines the depth (basic loss value) and breadth (lethality coefficient) of data value loss.

[0118] Specifically, the business control system uses a formula to combine the base loss value and the lethality coefficient. A simple implementation is multiplication: Energy Loss Integral = Base Loss Value * (1 + Lethality Coefficient). The +1 ensures that even if the lethality coefficient is 0, the integral is at least equal to the base loss value. For example, if the base loss value is 350 and the lethality coefficient is 0.9, then the energy loss integral = 350 * (1 + 0.9) = 665. This calculation method allows an operation with a high lethality rate to have a high final risk score even if its base loss value is not high, and vice versa, thus achieving a two-dimensional measurement of risk.

[0119] In some embodiments, the final integral can be calculated in several ways: Optionally, a more complex function can be used, such as integral = base loss value * e^(k * lethality coefficient), where k is an adjustment factor, using an exponential function to amplify the impact of the lethality coefficient; alternatively, the base loss value and the lethality coefficient can be used as two features, input into a pre-trained machine learning classification or regression model, and the model can directly output the risk level or integral. It is understood that the choice of formula and the adjustment of parameters are key aspects of risk control strategy optimization and need to be fine-tuned according to the actual business scenario; no limitations are imposed here.

[0120] In some embodiments, there may be significant differences in the dimensions and numerical ranges of the base loss value and the lethality coefficient. Direct multiplication could lead to one factor being overemphasized or ignored. To address this, the business control system normalizes or standardizes the base loss value and the lethality coefficient separately before calculation, scaling them to similar numerical ranges. For example, the base loss value can be divided by a historical average or maximum value to make it a relative value before being combined with the lethality coefficient in the calculation, ensuring that the contributions of the two factors in the final integral are relatively balanced.

[0121] S212. Retrieve the historical operation baseline of the operation and maintenance terminal to determine the energy consumption threshold when the operation and maintenance terminal performs a deletion operation within the historical maintenance window.

[0122] Refer to step S105, which will not be repeated here.

[0123] S213. When the energy loss integral exceeds the energy loss threshold, generate a risk warning and lock the session permissions of the operation and maintenance terminal.

[0124] Refer to step S106, which will not be repeated here.

[0125] In some embodiments, after a risk event occurs, the business management system introduces a closed-loop process of manual approval and baseline self-learning to balance operational flexibility and system adaptability. Specifically, in response to the received authorization instruction from the senior administrator corresponding to the risk warning, the business management system unlocks the session permission and allows the data processing instruction, marking the data processing instruction as a special compliance sample. Based on the actual energy loss integral generated by the data processing instruction, baseline drift correction is performed on the historical operation baseline of the operation and maintenance terminal.

[0126] Among them, the senior administrator authorization instruction refers to the instruction that a user with specific permissions, after being alerted by the risk control system, confirms and allows the operation; the special compliance sample refers to an operation instance that is initially judged as high-risk by the system but is confirmed as legal by manual verification. It includes the complete context of the operation and the calculated energy loss integral; the baseline drift correction refers to the dynamic adjustment of the historical operation baseline of the operation and maintenance personnel based on the new compliance sample, so that it can adapt to the new and legal operation mode.

[0127] Specifically, when an operation is locked due to exceeding the energy loss credit limit, a risk alert is sent to the senior administrator. The administrator logs into the approval interface of the business control system and can see detailed information about the blocked operation, including the operator, the original SQL statement, the number of affected data rows, the tables involved, the calculated energy loss credit, and the personal threshold exceeded. The administrator judges the reasonableness of the operation based on their business knowledge and operational plan. If it is confirmed as a legitimate, planned large-scale operation (e.g., quarterly data cleanup), the administrator can click the "Authorize and Allow" button. Upon receiving this instruction, the business control system immediately unlocks the operational terminal session and allows the original data processing instructions to continue execution. Simultaneously, the system stores this operation (especially its final calculated actual energy loss credit) as a compliant special case in the baseline learning library for subsequent baseline model updates.

[0128] In some embodiments, this step can be implemented in several ways. Optionally, the authorization process can be integrated with the enterprise's ITSM (IT Service Management) system, requiring administrators to associate a valid change request number when authorizing, to enhance the seriousness and traceability of audits. Optionally, for extremely high-risk operations (e.g., energy loss credits exceeding five times the threshold), the system can enforce a two-man rule, requiring confirmation and approval from two different senior administrators before the operation can be executed. Understandably, the core of this process is to establish a feedback loop from machine interception to human decision-making and then to machine learning, making the system increasingly intelligent; this is not limited here.

[0129] In some embodiments, authorization may be abused, leading to the wrongful permission to perform malicious operations. To address this, the business control system rigorously and immutably logs all authorization activities and periodically generates high-risk operation authorization reports. These reports highlight operations with extremely high energy consumption scores or those frequently authorized by specific administrators, providing a focus for the security audit team to review. Furthermore, the system can establish behavioral baselines for administrator authorization behavior itself. If an administrator's authorization frequency or risk value suddenly increases abnormally, an alert can be triggered, indicating a potential risk of account theft or abuse of privileges.

[0130] In some embodiments, when performing baseline drift correction, the business management system adopts a smooth and gradual update algorithm to ensure the stability and security of baseline adjustment. Specifically, the business management system calculates the overflow difference between the actual energy loss integral and the energy loss threshold, performs weighted smoothing on the overflow difference based on a preset trust growth factor, and obtains the baseline compensation value. The baseline compensation value is then added to the historical operating baseline to generate the updated energy loss threshold, and the updated energy loss threshold is synchronized to the configuration center of the business management system.

[0131] Among them, the overflow difference refers to the amount by which the energy loss integral of the compliant sample in this special case exceeds the current threshold; the trust growth factor is a coefficient less than 1 (e.g., 0.1) used to control the step size of a single baseline adjustment; weighted smoothing is an algorithm to prevent the model from being overly affected by a single sample; the baseline compensation value is the incremental adjustment that needs to be made to the old threshold in this case; and the configuration center is a component used for centralized management and distribution of configuration information (such as Nacos, ZooKeeper).

[0132] Specifically, after a special operation is authorized and allowed, the system obtains its actual energy consumption score and compares it with the operator's current energy consumption threshold. For example, if the actual score is 5000 and the current threshold is 4000, the overflow difference is 1000. Assuming the trust growth factor is preset to 0.1, the baseline compensation value = overflow difference * trust growth factor = 1000 * 0.1 = 100. Then, the system calculates the updated energy consumption threshold = original threshold + baseline compensation value = 4000 + 100 = 4100. This new threshold of 4100 is written back to the operator's historical operation baseline model. Finally, the business control system pushes this updated threshold to the configuration center. All risk control execution nodes deployed on different servers subscribe to changes in the configuration center, thereby obtaining and applying this new threshold in near real-time, ensuring the consistency of decision-making standards throughout the risk control system.

[0133] In some embodiments, this step can be implemented in several ways. Optionally, the trust growth factor may not be a fixed value but rather dynamically changing. For example, for multiple consecutive authorized operations exceeding the same threshold, the trust growth factor can be appropriately increased to accelerate the learning and adaptation process of the baseline. Optionally, in addition to adjusting the threshold (the boundary of the baseline), the energy loss integral of the special case samples can be added to the historical data distribution to recalculate the entire baseline model (such as the mean and standard deviation) for deeper model correction. It is understood that the purpose of smoothing is to achieve a balance between adaptability and stability, avoiding drastic oscillations in the baseline due to noisy data; this is not limited here.

[0134] In some embodiments, an operations and maintenance (O&M) personnel may perform an erroneous or unauthorized operation, which is then accidentally allowed, causing the baseline to drift in the wrong direction. To address this, the business control system provides baseline rollback and manual intervention capabilities. Security administrators can mark a specific compliant sample as an erroneous sample during post-event audits. Upon receiving this mark, the system removes the sample from the baseline learning library and recalculates the affected baseline, effectively performing a reverse compensation to restore the baseline to its state before the erroneous learning occurred. Simultaneously, administrators can also manually set or lock thresholds for specific O&M personnel directly in the configuration center to handle emergencies or implement stricter control policies.

[0135] In this embodiment, by constructing a data access heatfield based on data row access frequency and business metadata to quantify data business value, and combining cascading impact analysis and bitmap indexing technology to calculate a risk control model that accurately reflects the depth of operational damage, this method can shift the focus of risk assessment from the scale of the operation (such as the number of rows) to the substantive impact (value loss). This effectively solves the problem of high false alarm rates and low operational efficiency caused by existing technologies that rely solely on statistical behavior baselines and cannot distinguish between legitimate large-scale low-value data cleaning and illegal small-scale high-value data tampering. Thus, it achieves accurate, efficient, and adaptive control of operational risks in complex business scenarios.

[0136] The business management system in the embodiments of this invention is described below from the perspective of hardware processing. Please refer to [link / reference]. Figure 3 This is a schematic diagram of the physical device structure of the business management system in this application embodiment.

[0137] It should be noted that, Figure 3 The structure of the business management system shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present invention.

[0138] like Figure 3 As shown, the business management system includes a CPU 301, which can perform various appropriate actions and processes based on a program stored in ROM 302 or a program loaded into RAM 303 from storage section 308, such as executing the methods described in the above embodiments. RAM 303 also stores various programs and data required for system operation. CPU 301, ROM 302, and RAM 303 are interconnected via bus 304. I / O interface 305 is also connected to bus 304.

[0139] The following components are connected to I / O interface 305: input section 306 including audio input devices, push-button switches, etc.; output section 307 including liquid crystal display (LCD) and audio output devices, indicator lights, etc.; storage section 308 including hard disks, etc.; and communication section 309 including network interface cards such as LAN (Local Area Network) cards, modems, etc. Communication section 309 performs communication processing via a network such as the Internet. Drive 310 is also connected to I / O interface 305 as needed. Removable media 311, such as disks, optical disks, magneto-optical disks, semiconductor memories, etc., are installed on drive 310 as needed so that computer programs read from them can be installed into storage section 308 as needed.

[0140] In particular, according to embodiments of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present invention include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing computer programs for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 309, and / or installed from removable medium 311. When the computer program is executed by CPU 301, it performs the various functions defined in the present invention.

[0141] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. Each block in a flowchart or block diagram may represent a module, program segment, or portion of code, which contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those shown in the drawings.

[0142] Specifically, the business management system of this embodiment includes a processor and a memory. The memory stores a computer program. When the computer program is executed by the processor, it implements the operation and maintenance risk control method based on behavioral baselines provided in the above embodiment.

[0143] In another aspect, the present invention also provides a computer-readable storage medium, which may be included in the business management system described in the above embodiments; or it may exist independently and not be assembled into the business management system. The storage medium carries one or more computer programs, which, when executed by a processor of the business management system, enable the business management system to implement the behavior baseline-based operation and maintenance risk control method provided in the above embodiments.

[0144] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit it. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

[0145] As used in the above embodiments, depending on the context, the term "when..." can be interpreted as meaning "if...", "after...", "in response to determining...", or "in response to detecting...". Similarly, depending on the context, the phrase "when determining..." or "if (the stated condition or event) is interpreted as meaning "if determining...", "in response to determining...", "when (the stated condition or event) is detected", or "in response to detecting (the stated condition or event)".

Claims

1. A method for operation and maintenance risk control based on a behavior baseline, characterized in that, The method is applied to a business management and control system and comprises the following steps: Collecting read-write access frequencies of each data row in a production environment database, and constructing a data access hot field of an activity weight corresponding to each data row based on a time decay algorithm; specifically including: collecting read-write access frequencies of each data row in a production environment database, parsing business metadata of each data table to which the data row belongs, and determining the minimum retention value level of the data table; calculating the real-time heat of each data row based on a time decay algorithm; determining the higher value between the real-time heat and the preset minimum guaranteed score corresponding to the minimum retention value level as the activity weight; and constructing a data access hot field based on the activity weight of each data row; Listening to a data processing instruction submitted by an operation and maintenance terminal, and determining a target data set of the data processing instruction; specifically including: listening to a data processing instruction submitted by an operation and maintenance terminal, calling a metadata dictionary of a production environment database, and constructing a table association topology graph containing a target table and foreign key constraint relationship of the data processing instruction; based on the table association topology graph, when recursively traversing a downstream association table with a cascading deletion attribute of the target table, marking the downstream association table as an implicit damaged object; simulating an association query on the implicit damaged object in an isolated environment to obtain an association result; merging the association result into a data row pointed to by the data processing instruction to obtain the target data set; Mapping the target data set based on bitmap index technology in an isolated environment, and determining the activity weight of all data rows in the range corresponding to the target data set; Weighted sum of the activity weights of all data rows to calculate the energy loss integral corresponding to the data processing instruction; specifically including: weighted sum of the activity weights of all data rows to obtain a basic loss value; calculating a first proportion of the number of data rows directly pointed to by the data processing instruction to the total number of rows of the target table, and a second proportion of the number of affected rows in the implicit damaged object to the total number of rows of the downstream association table, and selecting the larger value between the first proportion and the second proportion as a lethality coefficient; calculating the energy loss integral based on the basic loss value and the lethality coefficient; The energy loss integral represents the degree of loss of system active data value caused by the execution of the data processing instruction; Calling a historical operation baseline of the operation and maintenance terminal to determine an energy loss threshold when the operation and maintenance terminal executes a deletion operation in a historical maintenance window; When the energy loss integral exceeds the energy loss threshold, generating a risk prompt and locking the session authority of the operation and maintenance terminal.

2. The method of claim 1, wherein, The step of mapping the target data set based on bitmap index technology in an isolated environment to determine the activity weight of all data rows in the range corresponding to the target data set, specifically includes: In the isolated environment, a primary-foreign key bitmap mapping index is constructed between the target table and the downstream association table; The primary-foreign key bitmap mapping index represents the corresponding association row position of each data row in the target table in the downstream association table. convert the data row to which the data processing instruction points into a first bitmap, and perform a projection operation through the main foreign key bitmap mapping index to generate a second bitmap representing affected rows in the implicit damaged object; respectively, and the data position in the data access hot field directly indexes the activity weight of the data position.

3. The method of claim 2, wherein, The step of weighting and summing the activity weights of all data rows to calculate the energy loss integral corresponding to the data processing instruction specifically includes: weighting and summing the activity weights of all data rows to obtain a basic loss value; respectively, and the data position in the data access hot field directly indexes the activity weight of the data position. According to the basic loss value and the mortality rate coefficient, the energy loss integral is calculated.

4. The method of claim 1, wherein, After the step of generating a risk prompt and locking the session authority of the operation and maintenance terminal when the energy loss integral exceeds the energy loss threshold, the method further includes: In response to the received senior administrator authorization instruction corresponding to the risk prompt, the locking state of the session authority is released and the data processing instruction is released, and the data processing instruction is marked as a special exception compliance sample; Based on the actual energy loss integral generated by the data processing instruction, baseline drift correction is performed on the historical operation baseline of the operation and maintenance terminal.

5. The method of claim 4, wherein, The step of performing baseline drift correction on the historical operation baseline of the operation and maintenance terminal based on the actual energy loss integral generated by the data processing instruction specifically includes: Calculate the overflow difference between the actual energy loss integral and the energy loss threshold, and perform weighted smoothing processing on the overflow difference based on a preset trust growth factor to obtain a baseline compensation value; The baseline compensation value is added to the historical operation baseline to generate an updated energy loss threshold, and the updated energy loss threshold is synchronized to the configuration center of the business control system.

6. A business management system, characterized by, The business control system includes one or more processors and a memory; the memory is coupled with the one or more processors, the memory is used to store computer program code, the computer program code includes computer instructions, and the one or more processors invoke the computer instructions to make the business control system execute the method of any one of claims 1-5.

7. A computer-readable storage medium comprising instructions, characterized in that, When the instructions run on the business control system, the business control system executes the method of any one of claims 1-5.

8. A computer program product, characterised in that, When the computer program product runs on the business control system, the business control system executes the method of any one of claims 1-5.

Images