A database user abnormal behavior detection system

Abstract

The application discloses a database user abnormal behavior detection system, and relates to the technical field of database user abnormal behavior detection, and comprises the following steps: constructing a database table association mode graph, determining a sensitive table set, a sensitive column set and a quasi-identifier combination based on a compliance checklist; extracting a query sequence and an access table set of a target session, determining a distance drop rate sequence, and calculating a coverage introduction rate in combination with the quasi-identifier combination; calculating a sensitive entropy impulse based on sensitive column data characteristics; constructing a multi-dimensional composite quantity, and determining the composite quantity. The application can improve the recognition ability and the security protection level of progressive sensitive behavior in database access.

Description

Technical Field

[0001] This invention relates to the field of database user abnormal behavior detection technology, and in particular to a database user abnormal behavior detection system. Background Technology

[0002] With the deepening of digital transformation, databases have become the core storage for enterprises' core data assets, containing a large amount of sensitive information such as private data, financial data, and core business data. The security of this data is directly related to the security of enterprise operations and the protection of user rights. In actual business scenarios, database users include multiple groups such as internal maintenance personnel, business personnel, and external authorized users. Users can initiate queries with legitimate permissions. Some of these queries do not directly access sensitive data, but rather gradually approach the sensitive scope and restore the sensitive data through intermediary tables, multiple extractions, or field reconstruction, posing a potential threat to data security.

[0003] Existing database user anomaly detection technologies mostly focus on monitoring single-dimensional access behavior, such as setting thresholds to monitor whether query frequency is too high, whether the amount of data accessed in a single instance exceeds the normal range, or whether there are abnormal changes in user permissions. These technologies have significant limitations. On the one hand, they ignore the temporal correlation of user behavior and the topological correlation between database tables. They cannot identify the infiltration behavior of users gradually accessing ordinary tables with primary and foreign key relationships to sensitive tables through multiple consecutive queries, ultimately approaching sensitive data. They also struggle to capture risky operations where users piece together data fragments through multiple queries to expand the scope of identifiable objects. On the other hand, existing technologies lack refined quantitative capabilities for assessing the risks of sensitive information. They neither differentiate the degree of harm caused by the leakage of different types of sensitive data nor effectively characterize the cumulative effect of sensitive information during the query process, resulting in an inability to accurately measure the actual impact of user behavior on data security. Summary of the Invention

[0004] The purpose of this invention is to solve the problem in the prior art that it is impossible to accurately identify abnormal behavior of database users gradually approaching sensitive data in continuous queries, and to propose a database user abnormal behavior detection system.

[0005] To address the problems existing in the prior art, the present invention adopts the following technical solution:

[0006] A database user abnormal behavior detection system includes:

[0007] 1. A database user abnormal behavior detection system, characterized in that it comprises:

[0008] The schema construction module is used to build a schema diagram based on database tables and determine the set of sensitive tables, the set of sensitive columns, and the combination of quasi-identifiers based on the compliance list;

[0009] The path mapping module is used to calculate the shortest path length from each node in the pattern graph to the sensitive table set, forming a shortest path length mapping table;

[0010] The distance sequence module is used to extract the accessed table set for each query and determine the distance decrease rate sequence of the accessed table set relative to the sensitive table set based on the shortest path length mapping table.

[0011] The coverage calculation module is used to determine the deduplication count for each query based on the quasi-identifier combination, and to calculate the coverage introduction rate based on the deduplication count of the first and last queries in the session window.

[0012] The entropy variable module is used to determine the sensitive entropy surge within a session window based on a set of sensitive columns.

[0013] The composite determination module is used to calculate the composite quantity based on preset strategy weights, distance descent rate sequence, sensitivity entropy surge and coverage introduction rate, and to determine the composite quantity.

[0014] Preferably, a schema diagram is constructed based on the database tables, and a set of sensitive tables, a set of sensitive columns, and a combination of quasi-identifiers are determined based on the compliance checklist, including:

[0015] Construct a schema graph by using database tables as nodes and the primary and foreign key relationships between tables as edges;

[0016] The set of sensitive tables and the set of sensitive columns are determined based on the compliance checklist, and a sensitive column weight is assigned to each sensitive column.

[0017] Based on the data uniqueness identification requirements in the compliance list, a quasi-identifier combination is determined, which is a combination of several columns.

[0018] Preferably, the shortest path length from each node in the pattern graph to the set of sensitive tables is calculated to form a shortest path length mapping table, including:

[0019] All tables in the sensitive table set are used as multi-source starting points. The shortest path length from each node in the pattern graph to the multi-source starting point is calculated using the graph shortest path algorithm to form a shortest path length mapping table.

[0020] Preferably, the accessed table set for each query is extracted, and based on the shortest path length mapping table, the distance decrease rate sequence of the accessed table set relative to the sensitive table set is determined, including:

[0021] Extract the target session from the database audit logs and organize the queries within the target session into a query sequence in chronological order.

[0022] Parse the SQL text of each query, extract all tables accessed by the query, and form an accessed table set;

[0023] Extract the shortest path length of all nodes in the access table set from the shortest path length mapping table, and take the minimum value as the minimum shortest path length for this query.

[0024] Calculate the difference between the minimum and shortest path lengths of two adjacent queries. If the difference is negative, set it to zero. Use the difference as the distance descent rate for that query to form a distance descent rate sequence.

[0025] Preferably, the deduplication count for each query is determined based on the quasi-identifier combination, and the coverage introduction rate is calculated based on the deduplication counts of the first and last queries within the session window, including:

[0026] For each query result, perform deduplication on column combinations that match the quasi-identifier combination definition, and update the deduplication count up to the current query.

[0027] Calculate the difference between the deduplication count for the first query and the deduplication count for the last query within the session window. Based on the ratio of this difference to the total number of queries within the session window, obtain the coverage introduction rate.

[0028] Preferably, determining the sensitivity entropy surge within the session window based on the sensitive column set includes:

[0029] The upper bound of the number of buckets for sensitive columns is set according to the data type of the sensitive columns in the sensitive column set. The upper bound of the number of buckets for sensitive columns is the maximum number of buckets for a single sensitive column when performing data bucketing statistics.

[0030] Based on the upper bound of the number of sensitive column buckets, the columns in the query results that belong to the sensitive column set are bucketed to generate the frequency of sensitive column bucketing and the total number of sensitive columns.

[0031] The ratio of the frequency of bucketing of sensitive columns to the total number of sensitive columns is used as the bucketing probability;

[0032] The sensitivity entropy of each sensitive column in the sensitive column set is calculated based on the bucketing probability, and the sensitivity entropy is aggregated into a weighted sensitivity entropy according to the sensitivity column weight.

[0033] The sensitivity entropy surge is obtained by comparing the weighted sensitivity entropy of the first query and the weighted sensitivity entropy of the last query within the session window.

[0034] Preferably, the composite quantity is calculated based on preset strategy weights, distance descent rate sequence, sensitivity entropy surge, and coverage introduction rate, including:

[0035] The distance descent rate sequence, sensitivity entropy surge, and coverage introduction rate are weighted based on preset policy weights and summed within the session window to obtain a composite quantity.

[0036] Preferably, determining the composite amount includes:

[0037] The upper bound of the graph diameter of the pattern graph is calculated. The upper bound of the graph diameter is the upper limit of the maximum value of the shortest path length from each node in the pattern graph to the set of sensitivity tables.

[0038] Based on the preset expected value of the composite quantity, the preset upper bound of the target false alarm, the upper bound of the graph diameter, the upper bound of the number of sensitive column buckets, and the preset strategy weights, the judgment threshold is calculated through the condensation inequality.

[0039] The composite quantity is compared with the judgment threshold. If the composite quantity is not less than the judgment threshold, it is judged as abnormal; otherwise, it is judged as normal.

[0040] Compared with the prior art, the beneficial effects of the present invention are:

[0041] 1. This invention constructs a database table association pattern diagram and clarifies the sensitive table set, sensitive column set, and quasi-identifier combination based on a compliance list. It extracts the query sequence and access table set of the target session to determine the distance descent rate sequence, calculates the coverage introduction rate in combination with the quasi-identifier combination, obtains the sensitivity entropy surge based on the characteristics of sensitive column data, and then obtains the composite quantity by weighting and summing the above indicators through preset strategy weights and making a judgment. This achieves comprehensive capture of multi-dimensional characteristics of continuous user query behavior and effectively identifies hidden abnormal behavior formed by gradually approaching sensitive data and accumulating sensitive information.

[0042] 2. This invention uses the sensitive table set as the starting point to calculate the shortest path length of each node in the multi-source starting pattern diagram, and combines the temporal sequence of the query sequence to obtain the distance decrease rate sequence. This accurately depicts the dynamic trend of the user's access path gradually approaching the sensitive data. At the same time, through the deduplication counting and coverage introduction rate calculation of the quasi-identifier combination, it captures the risky operation of the user expanding the coverage of identifiable objects through multiple queries, thereby improving the ability to identify hidden abnormal behaviors.

[0043] 3. This invention achieves refined quantification of the risk of sensitive information leakage by setting differentiated weights for different sensitive columns and combining bucketing probability and entropy value calculation. Then, based on the condensation inequality, it integrates parameters such as the expected value of the composite quantity and the upper limit of the target false alarm to derive the judgment threshold. While comprehensively identifying anomalies, it strictly controls the false alarm probability, thereby improving the reliability of database security protection. Attached Figure Description

[0044] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0045] Figure 1This is a functional block diagram of a database user abnormal behavior detection system provided in an embodiment of the present invention. Detailed Implementation

[0046] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0047] Example: This example provides a database user abnormal behavior detection system. See [link to example]. Figure 1 Specifically, including:

[0048] The schema construction module is used to build a schema diagram based on database tables and determine the set of sensitive tables, the set of sensitive columns, and the combination of quasi-identifiers based on the compliance list;

[0049] In embodiments of the present invention, a schema diagram is constructed based on database tables, and a set of sensitive tables, a set of sensitive columns, and a combination of quasi-identifiers are determined based on a compliance list, including:

[0050] Construct a schema graph by using database tables as nodes and the primary and foreign key relationships between tables as edges;

[0051] The set of sensitive tables and the set of sensitive columns are determined based on the compliance checklist, and a sensitive column weight is assigned to each sensitive column.

[0052] Based on the data uniqueness identification requirements in the compliance list, a quasi-identifier combination is determined, wherein the quasi-identifier combination is a combination of several columns;

[0053] Specifically, in constructing the schema diagram, information about all database tables is first extracted from the database's metadata. This metadata can be obtained through the database's built-in data dictionary or system tables, and includes basic information such as the table name, column names, column data types, structure, and inter-table relationships. The extracted metadata is then traversed, treating each database table as a separate node in the schema diagram. A unique identifier is assigned to each node, consistent with the name of the corresponding database table, ensuring a one-to-one correspondence between nodes and tables. The primary and foreign key relationships between tables are then parsed from the metadata. A primary key is one or more columns in a table used to uniquely identify each record, while a foreign key is one or more columns in one table that references the primary key of another table. When a foreign key exists in table A and references the primary key of table B, an edge is created in the schema diagram connecting the corresponding node in table A to the corresponding node in table B, representing the association between table A and table B through primary and foreign keys. The primary and foreign key relationships between all database tables are traversed and parsed, and corresponding edges are established one by one. This results in a schema graph where database tables are nodes and the primary and foreign key relationships between tables are edges. This schema graph can be stored in the form of an adjacency list or an adjacency matrix. Each row of the adjacency list corresponds to a node, and the row records other nodes connected to that node through edges and their corresponding primary and foreign key relationship information. The generated schema graph accurately reflects the connection structure between all tables in the database based on primary and foreign key relationships, providing a foundation for subsequent path calculation and risk reasoning based on sensitive table sets.

[0054] Specifically, a compliance list covering internal compliance requirements and external laws and regulations is obtained. This list clearly identifies the sensitive data types, business scenarios, and corresponding database storage scopes that require protection. Each table in the database is compared against the compliance list, and tables storing privacy data, financial data, core business data, and other data that meet the definition of sensitive data types are selected and integrated into a sensitive table set. For each table in the sensitive table set, its structure is further analyzed, and columns storing sensitive data are extracted. These columns must completely match the sensitive data field types specified in the compliance list, and all such columns are aggregated into a sensitive column set. Based on the compliance priority requirements for the leakage hazard levels of different sensitive data in the compliance list, a sensitive column weight is assigned to each sensitive column in the sensitive column set. The weight value is a positive value; the higher the leakage hazard level and the higher the compliance priority, the larger the corresponding weight value. This weight will be used in the subsequent calculation of weighted sensitivity entropy and sensitivity entropy surge to reflect the differences in the importance of different sensitive columns in anomaly detection.

[0055] Specifically, obtain the specific requirements for data uniqueness identification from the compliance checklist, extract column information involving individual weight identification risks, and identify objects that need to be approximately uniquely identified through column combinations. This column information includes, but is not limited to, potentially unique data fields such as name, date of birth, gender, address, phone number, postal code, employer information, and education or occupation information. Based on these requirements, traverse the tables in the database corresponding to the business field range, extracting columns from these tables that may be used to identify objects. These columns can be sensitive or non-sensitive, but must be directly related to the object's attributes. Perform combination tests on the extracted columns to evaluate the ability of different column combinations to distinguish the target object; that is, when the column values ​​in the combination are determined, can the corresponding object be limited to a very small range to meet the approximate uniqueness requirements? During the testing process, the repetition rate of each column combination should be calculated based on historical business data; the lower the repetition rate, the stronger the uniqueness identification ability of the combination. From the column combinations that passed the test, select those that match the compliance list requirements and appear frequently in queries, and define them as quasi-identifier combinations. Quasi-identifier combinations can contain columns from the same data table or multiple data tables. In subsequent deduplication and coverage introduction rate calculations, they serve as the basic set of fields for identifying the expansion trend of the data subject scope, ensuring that potential hidden abnormal behaviors can be effectively monitored.

[0056] The path mapping module is used to calculate the shortest path length from each node in the pattern graph to the sensitive table set, forming a shortest path length mapping table;

[0057] In an embodiment of the present invention, the shortest path length from each node in the pattern graph to the sensitive table set is calculated to form a shortest path length mapping table, including:

[0058] All tables in the sensitive table set are used as multi-source starting points. The shortest path length from each node in the pattern graph to the multi-source starting point is calculated using the graph shortest path algorithm to form a shortest path length mapping table.

[0059] Specifically, the process involves acquiring the constructed pattern graph and the determined set of sensitive tables. Each node in the pattern graph corresponds to a table in the database, and each table in the sensitive table set has a corresponding node in the pattern graph. All nodes corresponding to tables in the sensitive table set are marked as multi-source starting points, and the shortest path length of these starting points is initialized to zero. A suitable graph shortest path algorithm is selected based on the edge attributes in the pattern graph. If the pattern graph is unweighted, a breadth-first search algorithm is used; if the edges have weights representing the strength of association, Dijkstra's algorithm is used. Starting from the multi-source starting points, all nodes in the pattern graph are traversed according to the selected algorithm. During the traversal, for each non-starting point node, the total number of edges in the path from it to the nearest multi-source starting point is calculated. If the graph is weighted, the total weight of all edges on the path is calculated; this total is the shortest path length from that node to the multi-source starting point. After the traversal is complete, each node in the pattern graph is associated with its corresponding shortest path length, forming a structured shortest path length mapping table, which is used for subsequent sensitivity proximity measurement and behavioral path change trend analysis of any accessed table set. This mapping table is a fundamental data structure for evaluating the relative positional changes of database access operations and sensitive data spaces, which helps to achieve quantitative detection of abnormal access path behavior.

[0060] The distance sequence module is used to extract the accessed table set for each query and determine the distance decrease rate sequence of the accessed table set relative to the sensitive table set based on the shortest path length mapping table.

[0061] In embodiments of the present invention, the access table set for each query is extracted, and based on the shortest path length mapping table, the distance decrease rate sequence of the access table set relative to the sensitive table set is determined, including:

[0062] Extract the target session from the database audit logs and organize the queries within the target session into a query sequence in chronological order.

[0063] Parse the SQL text of each query, extract all tables accessed by the query, and form an accessed table set;

[0064] Specifically, to construct the access behavior trajectory of each database user, target sessions related to the target user are first extracted from the database audit logs. A target session refers to the set of all query activities generated by the same database user within a single login cycle under a specific session identifier. All query statements within this target session are sorted by timestamp from earliest to latest, forming an ordered query sequence. For each query in the query sequence, its corresponding SQL text is extracted. An SQL parser is used to perform lexical and syntactic analysis on the text, identifying the parts involving table references and parsing out all table names contained therein, including the actual names of tables referenced by aliases and the base tables involved in nested queries. All database tables extracted from each query statement are combined into an access table set, and the access table set sequence is recorded one by one according to the query order, used for subsequent calculation of the distance change trend between the access table set and the sensitive table set. This transforms unstructured query behavior records into structured access path data, providing a complete and time-series data input foundation for subsequent behavior analysis.

[0065] Extract the shortest path length of all nodes in the access table set from the shortest path length mapping table, and take the minimum value as the minimum shortest path length for this query.

[0066] Calculate the difference between the minimum and shortest path lengths of two adjacent queries. If the difference is negative, set it to zero. Use the difference as the distance descent rate for that query to form a distance descent rate sequence.

[0067] Specifically, to determine the proximity between each query and the sensitive table set, the extracted access table set for each query is first processed based on a pre-built shortest path length mapping table. For each query, all nodes within the access table set (i.e., all accessed database table names) are traversed, and the corresponding shortest path length value is retrieved from the shortest path length mapping table. This path length value represents the nearest connection distance of the table node relative to the sensitive table set. Among all the shortest path length values ​​corresponding to the access table set, the smallest value is selected as the minimum shortest path length for this query, used to measure how close the query behavior is to the sensitive table set in the schema diagram. Following the query order, the minimum shortest path lengths for adjacent queries are obtained, and the difference between the previous and subsequent queries is calculated. If the difference is positive, the original value is retained as the distance decrease rate for the current query; if the difference is negative or zero, it is normalized to zero to avoid representing invalid upward behavior. The above differences are recorded sequentially according to the query sequence to form a complete distance decrease rate sequence for the target session. This sequence reflects the dynamic trend of the access path gradually approaching the sensitive area and can effectively capture the degree to which database users gradually approach the sensitive area in the behavior path, providing continuous input features for subsequent composite behavior determination.

[0068] The coverage calculation module is used to determine the deduplication count for each query based on the quasi-identifier combination, and to calculate the coverage introduction rate based on the deduplication count of the first and last queries in the session window.

[0069] In embodiments of the present invention, the deduplication count for each query is determined based on the quasi-identifier combination, and the coverage introduction rate is calculated based on the deduplication counts of the first and last queries within the session window, including:

[0070] For each query result, perform deduplication on column combinations that match the quasi-identifier combination definition, and update the deduplication count up to the current query.

[0071] Specifically, to extract the coverage of identifiable personal information in user query behavior, the query results are structured based on quasi-identifier combinations after each query statement is executed. The quasi-identifier combination is a set of column names defined according to the uniqueness identification provisions in the compliance list, typically containing several data columns with cross-identification capabilities. For each query in the query sequence, the column data corresponding to the quasi-identifier combination is extracted from its result dataset. The values ​​of these columns are associated in combination order to form column value combinations, each corresponding to one or more records in the result dataset. A set is maintained to store historical column value combinations. This set is initially empty, recording only column value combinations that have appeared without storing specific record content. All column value combinations extracted in the current query are compared with the content in the historical set, and newly added column value combinations not appearing in the historical set are filtered out. The number of newly added column value combinations is counted. This number of newly added combinations is added to the deduplication count up to the previous query to obtain the deduplication count up to the current query. Simultaneously, the newly added column value combinations are added to the historical set to update the stored content. For the initial query, the deduplication count represents the number of newly added column value combinations in that query. Subsequent queries repeat the above extraction, comparison, statistics, and update operations to ensure that the deduplication count accurately reflects the cumulative number of unique objects covered by quasi-identifier combinations throughout the session. The deduplication count reflects the degree of coverage growth in identifiability for this query behavior, dynamically assessing the trend of users gradually piecing together identification information during continuous queries, and providing structured basic data support for the quantitative calculation of subsequent coverage introduction rates.

[0072] Calculate the difference between the deduplication count for the first query and the deduplication count for the last query within the session window. Based on the ratio of the difference to the total number of queries within the session window, obtain the coverage introduction rate.

[0073] Specifically, a session window refers to a set of queries organized chronologically from a series of query requests initiated by the same database user within a continuous time period during database auditing. A session window begins with the first query request and ends when the user no longer initiates a new request within a preset time interval or reaches the maximum duration limit. It is used to define the temporal range of user behavior, ensuring that various behavior-related metrics, including query frequency, data access paths, and the scope of sensitive information coverage, can be consistently analyzed and measured within a clearly defined sequence of operations.

[0074] Specifically, to calculate the coverage introduction rate within a session window, the first and last queries within the session window are located in the query sequence recorded by the system, and their corresponding deduplication counts are extracted. The deduplication count refers to the number of unique records obtained after extracting and deduplicating data from the query results based on quasi-identifier combinations for each query. The difference between the deduplication count for the last query and the deduplication count for the first query is calculated as the increment in the number of newly introduced unique records during the session. Further, the total number of queries within the session window is counted and recorded as the total number of queries. Dividing the above increment by the total number of queries yields the coverage introduction rate. The coverage introduction rate reflects the rate at which users increase the density of identifiable information through continuous query behavior during a session. It is an important quantitative indicator for assessing potential reconstruction identification risks and helps enhance the risk control capabilities for database usage behavior.

[0075] The entropy variable module is used to determine the sensitive entropy surge within a session window based on a set of sensitive columns.

[0076] In an embodiment of the present invention, determining the sensitivity entropy surge within a session window based on a set of sensitive columns includes:

[0077] The upper bound of the number of buckets for sensitive columns is set according to the data type of the sensitive columns in the sensitive column set. The upper bound of the number of buckets for sensitive columns is the maximum number of buckets for a single sensitive column when performing data bucketing statistics.

[0078] Specifically, the process involves obtaining a defined set of sensitive columns, iterating through each column, and extracting the data type of each column from the database metadata. Data types include, but are not limited to, numeric, character, and date types. For numeric sensitive columns, a reasonable bucketing granularity is set based on the distribution characteristics of their historical value ranges and precision requirements. For string sensitive columns, an upper limit for the number of buckets is set based on string length, character set size, and typical fuzzy query methods to avoid excessive information segmentation leading to entropy distortion. For date or time sensitive columns, the maximum allowed number of intervals is set as the upper limit for the number of buckets, considering both the time span and the minimum time granularity (e.g., days, hours, or minutes). For each data type of sensitive column, the maximum number of buckets must comprehensively consider data discriminability and computational efficiency to ensure that it effectively reflects the data distribution characteristics without wasting computational resources due to an excessive number of buckets. The final maximum number of buckets determined for each sensitive column is the upper limit for the number of buckets for that column, and this upper limit represents the maximum number of buckets allowed for a single sensitive column in subsequent data bucketing statistics.

[0079] Based on the upper bound of the number of sensitive column buckets, the columns in the query results that belong to the sensitive column set are bucketed to generate the frequency of sensitive column bucketing and the total number of sensitive columns.

[0080] Specifically, the process involves obtaining the defined set of sensitive columns and the upper bound of the number of buckets for each sensitive column, along with the result dataset returned by each query. For each query in the query sequence, all columns belonging to the sensitive column set are selected from the result dataset. For each such sensitive column, data bucketing is performed based on its data type and the preset upper bound of the number of buckets. If the sensitive column is numeric, the entire interval is divided evenly or by quantiles into several sub-intervals not exceeding the upper bound of the number of buckets, with each interval forming a bucket. If it is character, it is segmented by character length or grouped by enumerated values ​​to form buckets not exceeding the upper bound of the number of buckets. If it is date, it is divided by time granularity such as year, month, and day to form buckets not exceeding the upper bound of the number of buckets. All records of the sensitive column in the current query result are traversed, and the value of each record is assigned to the corresponding bucket. The number of records in each bucket is counted to obtain the bucketing frequency of the sensitive column. During the statistical process, the total number of records for each sensitive column participating in the bucketing statistics needs to be recorded simultaneously to form the total number of sensitive columns. This provides basic probability distribution information for subsequent calculation of sensitive entropy, ensuring that sensitive information is divided into statistical units within a controllable range, thereby extracting quantifiable information features without leaking the original data.

[0081] The ratio of the frequency of bucketing of sensitive columns to the total number of sensitive columns is used as the bucketing probability;

[0082] The sensitivity entropy of each sensitive column in the sensitive column set is calculated based on the bucketing probability, and the sensitivity entropy is aggregated into a weighted sensitivity entropy according to the sensitivity column weight.

[0083] Specifically, the process retrieves the frequency of bucketing of sensitive columns and the total number of sensitive columns generated for each query, along with the set of sensitive columns and their corresponding weights. For each sensitive column in the set, the process iterates through it. For each bucket of that sensitive column, the frequency of bucketing is divided by the total number of sensitive columns to obtain the bucketing probability, representing the relative proportion of that bucket within the sensitive column. If the total number of sensitive columns is zero, the bucketing probability is uniformly set to zero. For each sensitive column, all bucketing probabilities are iterated through. Using the entropy calculation formula for the probability distribution, all bucketing probabilities are multiplied by their logarithm, summed, and then the negative value is taken to obtain the sensitivity entropy of that column. A higher sensitivity entropy value indicates a more uniform distribution and stronger information uncertainty; a lower sensitivity entropy value indicates a higher concentration of values ​​in the column and a more significant risk of information leakage. After calculating the sensitivity entropy of all sensitive columns, the sensitivity entropy of each sensitive column is weighted and aggregated according to the sensitivity column weights previously set for each sensitive column in the compliance list. That is, the sensitivity entropy of each sensitive column is multiplied by its corresponding sensitivity column weight, and then all the product results are added together to obtain the weighted sensitivity entropy in the session window. This weighted sensitivity entropy comprehensively reflects the information distribution status and exposure risk level of all sensitive columns in the current query results, providing a quantitative basis for subsequent calculation of sensitivity entropy surge and judgment of abnormal behavior.

[0084] The sensitivity entropy surge is obtained by comparing the weighted sensitivity entropy of the first query and the weighted sensitivity entropy of the last query within the session window.

[0085] Specifically, to calculate the sensitivity entropy surge within a session window, the first and last queries are determined within the session window, and their corresponding weighted sensitivity entropies are obtained. The weighted sensitivity entropy is calculated by aggregating the bucketing probability and sensitivity column weights in each query result. Subtracting the weighted sensitivity entropy value of the first query from the weighted sensitivity entropy value of the last query yields the change in sensitivity information entropy during the execution of the session window, i.e., the sensitivity entropy surge. This surge reflects the cumulative effect of query activity on the complexity of sensitive information distribution over time. A larger sensitivity entropy surge indicates that later queries significantly enhance the richness or exposure of sensitive data compared to earlier queries, thus providing entropy-based index support for risk assessment of composite data, effectively avoiding misjudgments caused by fluctuations in entropy values ​​of single queries, and enhancing the stability and temporal sensitivity of overall behavior evaluation.

[0086] The composite determination module is used to calculate the composite quantity based on the preset strategy weights, distance descent rate sequence, sensitivity entropy surge and coverage introduction rate, and to determine the composite quantity.

[0087] In embodiments of the present invention, a composite quantity is calculated based on preset strategy weights, distance descent rate sequences, sensitivity entropy surge, and coverage introduction rate, and the composite quantity is determined, including:

[0088] The distance descent rate sequence, sensitivity entropy surge, and coverage introduction rate are weighted based on preset policy weights and summed within the session window to obtain a composite quantity.

[0089] Specifically, the distance decrease rate sequence, sensitive entropy surge, and coverage introduction rate within the current session window are obtained, along with preset strategy weights. These strategy weights include the weights of the corresponding distance decrease rate sequence, the corresponding sensitive entropy surge, and the corresponding coverage introduction rate. The weights of the distance decrease rate sequence, the sensitive entropy surge, and the coverage introduction rate are set to 0.4 and 0.2 respectively. These values ​​represent the importance of each indicator in the judgment of abnormal behavior. They can be determined by combining the contribution analysis of each indicator in historical abnormal cases and the priority of attention to the unique coverage growth of topology approximation sensitive information leakage in compliance requirements. The trend of distance approaching sensitive targets and the change in the distribution entropy of sensitive data play a dominant role in the judgment, while the coverage growth mainly reflects the data fusion capability, and its weight is appropriately reduced to avoid misjudgment. The cumulative value of the distance decline rate sequence within the session window is obtained by summing all elements in the sequence. This cumulative value is then multiplied by its corresponding policy weight to obtain the weighted contribution value of the distance decline rate sequence. Similarly, the weighted contribution value of the sensitivity entropy surge is obtained by multiplying it by its corresponding policy weight, and the weighted contribution value of the coverage introduction rate is obtained by multiplying it by its corresponding policy weight. The sum of these three weighted contribution values ​​is the composite value for the session window. This composite value comprehensively reflects the synthetic risk level of user behavior within the session window in terms of structural path proximity, the increasing trend of sensitive information, and the breadth of fusion. It will serve as the core quantitative basis for determining whether anomalies exist, ensuring dimensional consistency and risk significance balance among the three indicators.

[0090] The upper bound of the graph diameter of the pattern graph is calculated. The upper bound of the graph diameter is the upper limit of the maximum value of the shortest path length from each node in the pattern graph to the set of sensitivity tables.

[0091] Specifically, the constructed pattern graph and the generated shortest path length mapping table are obtained. The pattern graph contains nodes corresponding to all database tables and edges formed by the relationships between tables. The shortest path length mapping table records the shortest path length from each node to the sensitive table set. The shortest path length mapping table is traversed, and the shortest path length values ​​corresponding to all nodes in the table are extracted. These values ​​are compared, and the maximum value is selected. This maximum value reflects the path length of the node farthest from the sensitive table set in the current pattern graph. Simultaneously, considering the stability of the anomaly judgment threshold calculation, if the number of nodes in the pattern graph is small and the relationships are simple, the upper bound can be set to a fixed value of the actual maximum value plus one; if the number of nodes is large and the relationships are complex, it can be set to 1.2 to 1.5 times the actual maximum value to cover possible fluctuations in path length. This upper bound value is determined as the upper bound of the graph diameter of the pattern graph and used in the calculation of the composite quantity judgment threshold to ensure that the judgment range is not affected by accidental minimum values ​​of the path and has a reasonable safety margin.

[0092] Based on the preset expected value of the composite quantity, the preset upper bound of the target false alarm, the upper bound of the graph diameter, the upper bound of the number of sensitive column buckets, and the preset strategy weights, the judgment threshold is calculated through the condensation inequality.

[0093] Specifically, the expected value of the composite quantity, the upper bound of the target false alarm, the upper bound of the graph diameter, the upper bound of the number of sensitive buckets, and the preset policy weights are obtained. The expected value of the composite quantity is obtained by averaging the composite quantity data within the historical normal session window, reflecting the baseline level of the composite quantity under normal behavior. The upper bound of the target false alarm is set based on business compliance requirements and false alarm tolerance, typically determined by combining industry security standards, data leakage risk levels, and operational costs. It is a decimal between 0 and 1, with smaller values ​​indicating stricter control over false alarms. The upper bounds of the graph diameter and the number of sensitive buckets are pre-calculated parameters used to constrain the maximum range of topology path length and sensitive bucketing, respectively. The policy weights include the weight of the cumulative value of the distance decline rate sequence, the weight of the sensitivity entropy surge, and the weight of the coverage introduction rate. Since the composite quantity is a weighted sum of various indicators and each indicator has a clear value boundary, a bounded sum-form condensed inequality is chosen as the calculation basis. The specific calculation formula for the threshold is as follows:

[0094]

[0095] In the formula, To determine the threshold, The expected value of the composite quantity. , , These represent the policy weights corresponding to the cumulative value of the distance decline rate sequence, the surge in sensitivity entropy, and the coverage introduction rate, respectively. As the upper bound of the diameter of the figure, This refers to the number of queries within the session window. The upper bound of the number of sensitive column buckets, The target is falsely reported to the upper bound;

[0096] Specifically, the calculation method for the threshold originates from the idea of ​​controlling the probability of a random variable deviating from its expected value. This is consistent with the principle of the condensed inequality, which describes that the probability of the sum of bounded random variables deviating from their expected value has an upper limit. This risk of deviation can be controlled by setting boundary parameters. The composite quantity is a weighted sum of the cumulative value of the distance decline rate sequence, the sensitivity entropy surge, and the coverage introduction rate. Each component is a bounded variable. The cumulative value of the distance decline rate sequence is limited by the upper limit of the graph diameter and the number of session window queries. The sensitivity entropy surge is limited by the upper limit of the number of sensitive column buckets. The coverage introduction rate itself has a range of values. These boundaries collectively constitute the upper limit of the composite quantity's fluctuation. In the formula, the expected value of the composite quantity represents the average level of the composite quantity under normal behavior. The term within the square root calculates the upper limit of the total fluctuation based on the boundaries of each component and the strategy weights. The logarithmic term related to the target false alarm upper limit is used to convert the allowed false alarm risk into a specific fluctuation adjustment range, ensuring that the probability of the composite quantity exceeding the threshold does not exceed the target false alarm upper limit. The overall approach combines a baseline level of normal behavior with a controllable range of fluctuations to form a judgment threshold that reflects the characteristics of normal behavior while controlling the risk of false alarms. By clearly defining the boundaries and risk tolerance, a reasonable judgment limit is determined.

[0097] The composite quantity is compared with the judgment threshold. If the composite quantity is not less than the judgment threshold, it is judged as abnormal; otherwise, it is judged as normal.

[0098] Specifically, the final identification of abnormal behavior is based on the numerical relationship between the composite value and the judgment threshold. First, the composite value calculated by weighted summation within the session window is used as the fusion index value of the current session. Then, it is compared with the judgment threshold calculated based on the condensation inequality. If the composite value is greater than or equal to the judgment threshold, the behavior of the current session is judged to deviate from the normal range, and its data access process may have an abnormal trend exceeding the compliance range, thereby triggering an abnormal flag. If the composite value is less than the judgment threshold, the current session is judged to maintain normal access behavior within the preset false alarm probability control range, thereby outputting a normal judgment result. After the judgment is completed, the judgment result of the session window is recorded for subsequent abnormal behavior alarms or normal behavior archiving.

[0099] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A database user abnormal behavior detection system, characterized in that, include: The schema construction module is used to build a schema diagram based on database tables and determine the set of sensitive tables, the set of sensitive columns, and the combination of quasi-identifiers based on the compliance list; The specific steps for determining the quasi-identifier combination based on the compliance list are as follows: Based on the data uniqueness identification requirements in the compliance list, a quasi-identifier combination is determined, wherein the quasi-identifier combination is a combination of several columns; The path mapping module is used to calculate the shortest path length from each node in the pattern graph to the sensitive table set, forming a shortest path length mapping table; The distance sequence module is used to extract the accessed table set for each query and determine the distance decrease rate sequence of the accessed table set relative to the sensitive table set based on the shortest path length mapping table. The coverage calculation module is used to determine the deduplication count for each query based on the quasi-identifier combination, and to calculate the coverage introduction rate based on the deduplication count of the first and last queries in the session window. The specific steps for determining the deduplication count for each query based on the quasi-identifier combination and calculating the coverage introduction rate based on the deduplication counts of the first and last queries within the session window are as follows: For each query result, perform deduplication on column combinations that match the quasi-identifier combination definition, and update the deduplication count up to the current query. Calculate the difference between the deduplication count for the first query and the deduplication count for the last query within the session window. Based on the ratio of the difference to the total number of queries within the session window, obtain the coverage introduction rate. The entropy variable module is used to determine the sensitive entropy surge within a session window based on a set of sensitive columns. The specific steps for determining the sensitivity entropy surge within a session window based on the sensitive column set are as follows: The upper bound of the number of buckets for sensitive columns is set according to the data type of the sensitive columns in the sensitive column set. The upper bound of the number of buckets for sensitive columns is the maximum number of buckets for a single sensitive column when performing data bucketing statistics. Based on the upper bound of the number of sensitive column buckets, the columns in the query results that belong to the sensitive column set are bucketed to generate the frequency of sensitive column bucketing and the total number of sensitive columns. The ratio of the frequency of bucketing of sensitive columns to the total number of sensitive columns is used as the bucketing probability; The sensitivity entropy of each sensitive column in the sensitive column set is calculated based on the bucketing probability, and the sensitivity entropy is aggregated into a weighted sensitivity entropy according to the sensitivity column weight. The sensitivity entropy surge is obtained by comparing the weighted sensitivity entropy of the first query and the weighted sensitivity entropy of the last query within the session window. The composite determination module is used to calculate the composite quantity based on preset strategy weights, distance descent rate sequence, sensitivity entropy surge and coverage introduction rate, and to determine the composite quantity.

2. The database user abnormal behavior detection system according to claim 1, characterized in that, A schema diagram is constructed based on the database tables, and the set of sensitive tables, the set of sensitive columns, and the combination of quasi-identifiers are determined based on the compliance checklist, including: Construct a schema graph by using database tables as nodes and the primary and foreign key relationships between tables as edges; The set of sensitive tables and sensitive columns are determined based on the compliance checklist, and a sensitive column weight is assigned to each sensitive column.

3. The database user abnormal behavior detection system according to claim 1, characterized in that, Calculate the shortest path length from each node in the pattern graph to the set of sensitive tables, forming a shortest path length mapping table, including: All tables in the sensitive table set are used as multi-source starting points. The shortest path length from each node in the pattern graph to the multi-source starting point is calculated using the graph shortest path algorithm to form a shortest path length mapping table.

4. The database user abnormal behavior detection system according to claim 1, characterized in that, Extract the accessed table set for each query, and based on the shortest path length mapping table, determine the distance decrease rate sequence of the accessed table set relative to the sensitive table set, including: Extract the target session from the database audit logs and organize the queries within the target session into a query sequence in chronological order. Parse the SQL text of each query, extract all tables accessed by the query, and form an accessed table set; Extract the shortest path length of all nodes in the access table set from the shortest path length mapping table, and take the minimum value as the minimum shortest path length for this query. Calculate the difference between the minimum and shortest path lengths of two adjacent queries. If the difference is negative, set it to zero. Use the difference as the distance descent rate for that query to form a distance descent rate sequence.

5. A database user abnormal behavior detection system according to claim 1, characterized in that, The composite quantity is calculated based on preset strategy weights, distance descent rate sequence, sensitivity entropy surge, and coverage introduction rate, including: The distance descent rate sequence, sensitivity entropy surge, and coverage introduction rate are weighted based on preset policy weights and summed within the session window to obtain a composite quantity.

6. The database user abnormal behavior detection system according to claim 1, characterized in that, Determining the amount of composite material includes: The upper bound of the graph diameter of the pattern graph is calculated. The upper bound of the graph diameter is the upper limit of the maximum value of the shortest path length from each node in the pattern graph to the set of sensitivity tables. Based on the preset expected value of the composite quantity, the preset upper bound of the target false alarm, the upper bound of the graph diameter, the upper bound of the number of sensitive column buckets, and the preset strategy weights, the judgment threshold is calculated through the condensation inequality. The composite quantity is compared with the judgment threshold. If the composite quantity is not less than the judgment threshold, it is judged as abnormal; otherwise, it is judged as normal.

Images