Database autonomous protection method based on dual-system architecture

Abstract

The invention discloses a database autonomous protection method based on a dual-system architecture, and belongs to the technical field of database information security. The static measurement agent calculates SM3-256 hash values for all key files of a database in a trusted environment, and the SM3-256 hash values serve as static trusted references to be uploaded and safely stored to a trusted analysis center. And the dynamic measurement agent loads an eBPF program to enter a baseline learning mode. The monitoring and intelligent response during operation comprises static monitoring, dynamic monitoring and correlation analysis and response. Through the design of the dual-system architecture, the protection system and the computing system run in parallel, and the continuous protection capability of the database system is realized. Therefore, the database system has deep security protection capability, and confidentiality, integrity and availability of the database system can be effectively guaranteed when the database system is faced with known and unknown threats.

Description

Technical Field

[0001] This invention relates to the field of database information security technology, and in particular to hardware-enhanced trusted computing and runtime deep security protection for relational databases in a Linux environment. Background Technology

[0002] Patent publication CN120378179A, titled "A Database Security Protection Method," proposes a database security protection scheme based on bypass traffic mirroring and deep packet inspection. This scheme replicates database traffic using SPAN port mirroring technology on a switch and performs SQL protocol parsing and rule-based threat signature matching on the traffic. However, its shortcomings include:

[0003] a) Defense blind spot: Unable to defend against attacks that do not involve database network protocol traffic, such as unauthorized tampering with static configuration files of the database system (such as pg_hba.conf for PostgreSQL, my.cnf for MySQL), malicious replacement of database binary programs, or malicious inter-process operations through local IPC / shared memory mechanisms.

[0004] b) Limitations and performance overhead: The ability to parse protocols and inspect content in TLS / SSL encrypted database session traffic is limited. In high-concurrency read and write scenarios, traffic mirroring and deep inspection may introduce significant CPU and memory resource overhead, leading to potential business delays or packet loss.

[0005] Patent publication number CN120277706A, entitled "A Secure Access Method for Databases," proposes a database access control scheme based on multi-factor authentication and access control lists. This method verifies the identity of client devices and users through a pre-configured whitelist of client device MAC addresses / IP addresses and a lookup table of user identity credentials, and provides a temporary access application and approval channel based on one-time passwords or short-term access tokens. Its drawback is:

[0006] a) Reliance on static configuration and vulnerability to deception: It relies heavily on the real-time updates and maintenance of static whitelists and credential databases, making it difficult to effectively deal with phishing attacks, man-in-the-middle attacks leading to credential theft, and advanced attack methods such as device MAC / IP address spoofing.

[0007] b) Backdoor risk: The introduction of temporary access channels has an inherent contradiction between operational convenience and the principle of least privilege. Due to oversights in operation and maintenance management processes or improper configuration of approval strategies, it may evolve into an attack backdoor with continuous exploitation value.

[0008] c) Lack of runtime monitoring: The existing solutions are limited to identity and device authentication during the database connection establishment phase. They lack real-time monitoring, anomaly detection, and blocking capabilities for malicious SQL operations, high-risk system command execution, or unauthorized access to sensitive data performed by authenticated users within the database session. This invention, through refined behavioral baseline modeling (including multivariate statistical analysis of network connection characteristics and weighted similarity comparison of process system call sequences), effectively overcomes the shortcomings of existing solutions in intelligent runtime behavioral detection and analysis.

[0009] In summary, existing technical solutions either focus on external network traffic analysis or on authentication at access points, both of which are "plug-in" security protection mechanisms based on external boundaries or access points. These mechanisms cannot achieve fine-grained, real-time, and continuous hardware-enhanced trusted state measurement and runtime behavior monitoring of internal components such as the database system kernel, processes, file systems, and network stacks, and are even less capable of building an intrinsic security system with autonomous identification, response, and recovery capabilities. Furthermore, even some general host security monitoring solutions based on eBPF or mandatory access control generally lack in-depth analysis capabilities and high-performance optimizations for specific database behavior patterns, making them difficult to directly apply to high-concurrency and high-availability database scenarios. This invention, however, achieves high-performance in-depth analysis capabilities in high-concurrency database scenarios through optimization of advanced statistical and sequence analysis models targeting specific database behavior patterns. Summary of the Invention

[0010] Database systems face various advanced persistence threats during dynamic operation, such as configuration file tampering, service process hijacking, or direct data file modification. These threats can compromise the confidentiality, integrity, and availability of the database system. Traditional static integrity checks or vulnerability scans are ineffective in detecting dynamic threats such as runtime memory injection, abnormal process behavior, or zero-day exploits. Existing dynamic monitoring solutions generally suffer from high performance overhead, high false positive rates, and insufficient decoupling from core database business logic, making it difficult to achieve real-time security verification in high-performance scenarios.

[0011] This invention aims to propose a database autonomous protection method based on a dual-architecture approach, integrating static integrity measurement with intelligent dynamic behavior monitoring based on adaptive modeling, in accordance with the Trusted Computing 3.0 architecture specification. This method constructs a protection system parallel to the computing system, enabling continuous perception, intelligent analysis, and timely response to the database's runtime security status. This significantly enhances the database system's autonomous protection capabilities, ultimately constructing a database system with inherent immune characteristics.

[0012] This invention proposes a database dynamic and static integrated protection system and method based on a dual-system architecture. It follows the design concept of "separation of computation and protection" and is achieved through a technical approach of dual-system architecture, layered protection, multi-dimensional monitoring, intelligent modeling and adaptive analysis, and timely response.

[0013] The technical solution adopted in this invention is a database self-protection method based on a dual-architecture system. The system for implementing this method includes:

[0014] Computing architecture: It carries the core business logic of the database, including the database master process, client tools, upper-layer business applications, and static measurement agent, dynamic measurement agent (user-space controller), and protection agent deployed on the database server.

[0015] Protection system: responsible for security monitoring, analysis, decision-making and response, including independently deployed trusted analysis center, security policy executor, and hardware root of trust TCM and corresponding software stack that provide a trusted foundation.

[0016] The core components for implementing this method include:

[0017] a) Static Measurement Agent: Deployed in the user space of the database server, it performs integrity hash value measurement based on the SM3-256 algorithm on key static files related to the database, thereby realizing the integrity and reliable verification of static assets of the computing system.

[0018] b) Dynamic Measurement Agent: Implemented as a collection of eBPF programs loaded into the Linux kernel and user-space agent programs. The user-space controller is responsible for interacting with the kernel-space eBPF programs to perform event data interaction, preliminary filtering and aggregation, and feature preprocessing, and then reporting the processed events to the Trusted Analysis Center for advanced modeling and analysis.

[0019] c) Protection Agent: Implemented as an independent thread or module within the user-space controller process of the dynamic measurement agent, it receives instructions through an internal message queue to avoid the overhead and complexity of inter-process communication (IPC). It is responsible for receiving protection instructions from the security policy executor and calling the operating system interface to execute corresponding security response actions.

[0020] d) Trusted Analysis Center: Deployed on a separate security management server, serving as the core for policy management, behavioral baseline modeling and maintenance, threat analysis, and decision-making within the entire protection system.

[0021] e) Security Policy Executor: As a lower-level module of the Trusted Analysis Center, it is responsible for receiving threat analysis reports generated by the Trusted Analysis Center, conducting threat level assessments and matching response strategies, and distributing specific protection instructions to the protection agents in the computing system through a secure communication channel.

[0022] f) Hardware Trust Root (TCM) and TPCM (Software and Hardware): By expanding the measurement scope of the hardware trust root, the user-mode controller programs of the static and dynamic measurement agents, as well as the SM3 hash values ​​of the eBPF bytecode files they are loading, are incorporated into the measurement chain of the platform configuration register (PCR). Through a remote verification protocol based on SM2 digital signatures, the code of the protection components in the current computing system is verified to the Trust Analysis Center to ensure that it has not been tampered with.

[0023] The specific implementation steps are as follows:

[0024] Phase 1: Establishing a credible benchmark.

[0025] The static metrics agent calculates the SM3-256 hash value for all critical files (binary programs, configurations, library files, etc.) in a trusted environment, uploads it as a static trusted baseline, and securely stores it in the Trusted Analysis Center. The dynamic metrics agent loads the eBPF program and enters baseline learning mode. Behavioral baseline learning should be conducted in the "known security" phase after the database system is deployed but before the official business goes live, or in a thoroughly audited and isolated test environment by replaying normal business traffic. During this phase, the system collects behavioral data such as system call sequences, network connections, and file accesses. A normal behavioral baseline model of the database system is established using multivariate statistical methods (such as multivariate Gaussian distribution) and sequence analysis (such as LCS alignment), and stored in the behavioral baseline database of the Trusted Analysis Center.

[0026] Phase Two: Runtime Monitoring and Intelligent Response.

[0027] Static monitoring: The static measurement agent verifies the consistency between the file's SM3 hash value and the baseline value through multiple triggering modes (before startup, periodically, and event-driven), and immediately alerts and responds when tampering is detected.

[0028] Dynamic monitoring: The dynamic measurement agent continuously monitors the runtime behavior of database processes (files, network, processes, memory, permissions, etc.) through eBPF programs. Through kernel-mode filtering (process whitelists, multi-level mapping) and user-mode analysis, it compares events with behavioral baselines (using methods such as multivariate statistical Mahalanobis distance and weighted sequence similarity) in real time to detect abnormal deviations.

[0029] Correlation Analysis and Response: The Trusted Analysis Center performs multi-source correlation analysis on dynamic and static alarm events to assess threat levels and match preset response strategies (IF-THEN-ELSE rules) based on the detection results. The security policy executor sends instructions to the protection agent to execute automated response actions (such as alarms, blocking, isolation, and process termination).

[0030] Compared with existing technologies, this invention, through a dual-architecture design, enables the protection system and the computing system to operate in parallel, achieving continuous protection capabilities for the database system. When faced with security threats, the protection system can:

[0031] Accurate Identification: Based on predefined static benchmarks and dynamic behavioral baselines built through advanced statistics and sequence analysis, combined with multi-dimensional contextual correlation, it accurately identifies anomalous behaviors and potential threats.

[0032] Automatic response: Based on real-time threat assessment results and preset response strategies, automatically execute fine-grained protective actions such as blocking, isolation, and alarms.

[0033] Automatic recovery: After confirming that the threat has been eliminated, automatically perform operations such as service restart, file rollback, and network connection restoration.

[0034] This mechanism enables database systems to possess deep security protection capabilities, effectively ensuring the confidentiality, integrity, and availability of the database system when facing known and unknown threats. Attached Figure Description

[0035] Figure 1 This diagram illustrates the overall architecture of a database dynamic and static measurement system based on the Trusted Computing 3.0 dual-system architecture. It showcases the parallel architecture and interaction flow of the computing system (business components such as the database main process) and the protection system (static measurement agent, dynamic measurement agent, trusted center, and security policy executor), reflecting the design concept of the dual-system architecture.

[0036] Figure 2 The overall flowchart shows the complete closed-loop process from initialization, monitoring, detection, analysis to response. Detailed Implementation

[0037] This invention aims to construct a trusted database system with endogenous immune characteristics and provide an innovative method for security monitoring and proactive protection. This method deeply integrates static file integrity measurement of the database with runtime dynamic behavior monitoring based on statistical learning and sequence analysis. It is grounded in the dual-architecture of Trusted Computing 3.0 proposed by Academician Shen Changxiang, and combines the file integrity of the database system guaranteed by the Hardware Trust Root (TCM), the kernel-level non-intrusive deep monitoring capabilities of eBPF (Extended Berkeley Packet Filter) technology, the data path acceleration technology of XDP (eXpress Data Path), and the cryptographic strength of the national cryptographic algorithm SM3-256. This achieves end-to-end trusted protection for the database system, from the underlying hardware trust root to the dynamic behavior of the application layer.

[0038] The database self-protection method based on a dual-architecture proposed in this invention includes the following specific implementation steps:

[0039] Process 1: Dual-architecture initialization and baseline establishment

[0040] 1.1 Dual-system architecture deployment

[0041] Deploy system components according to the Trusted Computing 3.0 dual-architecture concept.

[0042] a) Computing architecture: Deployment of database system instances, database management interface web application, static measurement proxy, dynamic measurement proxy user-mode controller, and protection proxy. The static measurement proxy and dynamic measurement proxy are deployed locally on the database server as front-end proxies.

[0043] b) Protection system: Integrate the hardware root of trust (TCM) and corresponding software components, deploy a trusted analysis center and a security policy executor, and deploy them as backend services in an isolated security management server.

[0044] c) eBPF Environment Preparation: Check the Linux kernel version of the target operating system (≥4.18 required, ≥5.4LTS recommended) to ensure full support for the required features of eBPF, and install eBPF development and runtime dependencies (such as libbpf, LLVM / Clang ≥ 10.0, BCC toolset). To ensure the compatibility and stability of eBPF programs on different Linux kernel versions, this invention relies on kernel BTF (BPF Type Format) information and CO-RE (Compile Once - Run Everywhere) technology, enabling eBPF programs to be compiled once and run on multiple kernel versions, avoiding recompilation problems caused by kernel data structure offsets.

[0045] 1.2 Establishment of Static Reference Values

[0046] The static metrics agent recursively scans all binary files, configuration files, and library files related to database operation in the database directory based on a pre-defined policy configuration file written in Yaml. For each scanned file, a 256-bit SM3 hash value is calculated using the national cryptographic algorithm SM3-256. Information such as the file's absolute path, file type (e.g., executable file, configuration file, library file), SM3 hash value, file inode, file size, last modified timestamp, and file permissions (octal) are encapsulated into a baseline record and uploaded to the static trusted baseline database of the Trusted Analysis Center via a secure channel based on the national cryptographic algorithm SSL / TLS (GM / T 0024-2014) (which can employ SM2-based certificate authentication and SM4-based data storage encryption).

[0047] 1.3 Establishment of Dynamic Behavioral Baselines and Model Construction

[0048] Load and activate the eBPF dynamic monitoring program, putting it into behavior baseline learning mode. This learning process should be performed during the "known security" phase after database system deployment and before official business launch, or in a thoroughly security-audited and isolated test environment by replaying normal business traffic. The eBPF program is precisely mounted to the following kernel points:

[0049] a) System call entry points: system calls related to process execution, network communication, file access, and memory management, such as sys_execve, sys_connect, sys_openat, sys_read, sys_write, and sys_mmap.

[0050] b) Kernel function trace points (kprobe): Deeply monitor the execution paths of kernel functions related to process execution (do_execveat_common), network communication (tcp_connect, tcp_sendmsg), file access (vfs_read, vfs_write), etc.

[0051] c) Tracepoint events: Mounted to kernel static tracepoints such as sched / sched_process_exec, filemap / filemap_read_pages to ensure monitoring stability and version compatibility.

[0052] To ensure the relevance and purity of the collected data, the eBPF program implements a multi-layered filtering mechanism in kernel space: First, it uses the `bpf_get_current_comm()` function to obtain the executable filename of the current process for initial filtering; then, it recursively traces its parent process chain to establish a process derivation graph; finally, it captures only behavioral events related to the database master process (such as Postgres) and all its directly or indirectly derived child / worker processes. This design ensures that only database workload-related events are collected, greatly reducing data noise. The collected raw event data is transmitted in real time to the user-space daemon process through an efficient double-buffering mechanism—the eBPF Ring Buffer structure. This daemon process serializes, timestamps, and batch packages the events before injecting them into high-throughput message queues such as Kafka for consumption by downstream feature engineering pipelines.

[0053] Behavioral data flowing into real-time stream processing engines (such as Flink or Spark Streaming) is transformed into network connection behavior features and process execution sequence features through a feature engineering module. Simultaneously, a multimodal modeling strategy integrating multivariate statistical process control (MSPC) and intelligent sequence alignment is employed to construct a dynamic behavioral baseline for the database system.

[0054] a) Network Connectivity Behavior Baseline: For network connectivity behavior, this method models the connectivity characteristics of a specific target (IP:Port) within a rolling time window (e.g., 1 minute). Let the extracted feature vector be denoted as . ,in:

[0055] 𝑓: Frequency (number of times) of accessing a specific target IP address and port (such as 192.168.1.100:445).

[0056] 𝑏 𝑜𝑢𝑡 The total number of bytes sent from this port.

[0057] 𝑏 𝑖𝑛 The total number of bytes received by this port.

[0058] d 𝑚𝑎𝑥 : Longest connection duration.

[0059] d p90 The upper limit of the time that 90% of the connections can complete after sorting, used to stably reflect the duration level of the vast majority of normal connections.

[0060] Record the data collected during the normal phase A sample of network behavior characteristics ,That These are the feature dimensions (such as the 5 dimensions mentioned above). To overcome the common heavy-tailed distribution problem in network data, a logarithmic transformation preprocessing is first performed on each feature dimension:

[0061]

[0062] The transformed data is denoted as This invention, through the... A multivariate Gaussian distribution is used for modeling, and its mean vector is estimated using a robust estimation method (minimum covariance determinant, MCD). Covariance Matrix This is to resist minor anomalies that may exist in the training data.

[0063] For a new network behavior observation vector First, perform the same logarithmic transformation to obtain Then, the squared Mahalanobis distance between it and the robust baseline model is calculated. :

[0064]

[0065] This squared Mahalanobis distance measures the degree to which the current behavior deviates from the center of the normal group in a multivariate feature space. Based on this, a dynamic anomaly threshold is set. Given a significance level (Typically set to 0.001), this threshold is determined to be the number of degrees of freedom. Chi-square distribution Quantiles. Specifically, due to the square of the Mahalanobis distance... Obeying the degree of freedom Chi-square distribution Therefore, the threshold It can be calculated using the following formula:

[0066]

[0067] in, The cumulative distribution function of a chi-square distribution with p degrees of freedom is denoted as . The value corresponding to the time. Any value that satisfies All such actions were judged as network connection errors.

[0068] b) Process Behavior Baseline: For process execution behavior, this method performs K-gram (typically K=5) sliding window segmentation on the system call sequence to generate continuous fixed-length sequence fragments. This invention constructs a reliable behavior sequence pattern library composed of a large number of known normal system call K-gram sequences. The library consists of all normal K-gram sequences generated during the "known safe" phase.

[0069] For a newly observed system call sequence to the pattern Each template sequence in The similarity of their weighted longest common subsequences is calculated through comparison. This invention improves upon the traditional LCS algorithm by assigning different weights to different system calls. To reflect their security importance (e.g., execve has a weight of 3.0, connect has a weight of 2.5, openat has a weight of 2.0, and the others have a weight of 1.0).

[0070] remember For sequence and The set of system calls contained in the longest common subsequence, then its weighted length for

[0071]

[0072] sequence With template Weighted similarity Defined as:

[0073]

[0074] Then the sequence The maximum possible similarity with the entire pattern library is:

[0075]

[0076] Set a dynamic statistical significance threshold (Initialized to 0.85). If If so, the current process execution sequence is determined to be abnormal. Threshold It can be periodically adjusted based on the distribution of similarity to historical normal sequences.

[0077] This baseline model is not statically invariant, but rather possesses dynamic evolution capabilities. The system supports the following update mechanisms:

[0078] Periodic retraining: During periods of low business activity, the MCD estimator is refitted with recent normal data and the sequence pattern library is updated to adapt the baseline to the natural evolution of the business.

[0079] Concept drift detection: Based on hypothesis testing (such as the Kolmogorov-Smirnov test), monitor changes in feature distribution, automatically trigger the model update process, and prevent the false alarm rate from increasing due to baseline aging.

[0080] Finally, the baseline model parameters after training (such as...) , , The threshold values ​​are uploaded and stored in the behavior baseline database of the Trusted Analysis Center through a secure channel such as gRPC or a customized secure RPC based on the national cryptographic standard SSL / TLS (GM / T 0024-2014), for the detection nodes to download and use.

[0081] Process 2: Runtime Static Integrity Measurement

[0082] 2.1 Trigger Condition Detection

[0083] Static metric proxy supports multiple triggering modes:

[0084] a) Forced verification before startup: Before the database service officially starts, the `ExecStartPre` hook used by systemd to manage the service automatically triggers integrity checks on critical binary data and configuration files, ensuring the reliability of the underlying environment before service startup. This mechanism is adaptable to different service startup management methods.

[0085] b) Periodic timed verification: Use cron jobs or internal timer mechanisms to periodically check the integrity of critical files at preset time intervals (e.g., every 10 minutes).

[0086] c) Event-Driven Verification: Utilizing the Linux kernel's inotify mechanism, critical database file directories are monitored in real time, triggering immediately upon file creation, modification, or deletion events. Furthermore, this invention combines eBPF to intercept and pre-check file operations at the VFS (Virtual File System) layer, enabling prior security judgment and blocking of file operations. This ensures judgment and blocking before actual modification operations occur, and this event can be used as the basis for triggering a one-time, targeted static file integrity verification.

[0087] d) Manually triggered verification: initiated by the administrator.

[0088] 2.2 Document Integrity Calculation

[0089] For each file to be verified, the static metrics agent calls the same SM3 algorithm as in the baseline establishment phase to recalculate its cryptographic hash value. To optimize the performance of integrity metrics for large files, asynchronous I / O block reading of the file (e.g., reading 8KB or 64KB data blocks at a time) and SM3 streaming update calculation are used to avoid loading large files into memory at once.

[0090] 2.3 Benchmark Value Comparison

[0091] The currently calculated SM3 hash value is compared byte-level precisely with the baseline value of the corresponding file securely obtained from the baseline value library of the Trusted Analysis Center. If the SM3 hash values ​​match exactly, a successful verification event log is recorded; if they do not match, a high-priority file integrity anomaly alarm is immediately generated. The alarm content includes the file path, the actual content hash of the tampered file, the baseline hash, the detection timestamp, and the file metadata (size, permissions, inode).

[0092] 2.4 Response Action Execution

[0093] Execute the corresponding actions according to the preset security response strategy:

[0094] a) Alarm notification: Send real-time alarms to security administrators via email, SMS gateway API, or integrated SIEM system.

[0095] b) Service blocking: If it is detected at startup, the database service process can be prevented from starting through systemd unit file configuration or script logic.

[0096] c) File isolation: Move the tampered file to a preset secure isolation directory (such as / var / lib / database_quarantine) and change its access permissions to 000.

[0097] d) Service degradation: Temporarily restrict specific functions of the database (such as read-only mode or restricting external connections) by modifying the database configuration file or firewall rules.

[0098] In addition, when static integrity verification detects high-risk tampering behavior, the Trusted Analysis Center can issue instructions to the dynamic measurement agent to trigger more stringent and granular dynamic behavior monitoring of the affected database instance or related processes in order to discover potential subsequent attack behaviors.

[0099] Process 3: Runtime Dynamic Behavior Monitoring

[0100] 3.1 eBPF program loading and mounting

[0101] The user-space controller of the dynamic metrics agent loads the compiled eBPF program (bytecode) into the kernel. Before loading, this eBPF bytecode undergoes a rigorous security check by the Linux kernel's eBPF verifier to ensure it does not contain code logic such as loops or out-of-bounds access that could cause kernel locking or crashes, thus guaranteeing kernel stability. The eBPF program set contains multiple monitoring subroutines:

[0102] a) File system operation monitoring subroutine: By mounting system calls such as sys_openat, sys_read, sys_write, sys_unlinkat, and sys_renameat via kprobe, and file system events such as tracepoint mounting to ext4_file_open via tracepoint, it can detect unauthorized access to sensitive database files, malicious I / O operations (such as illegal truncation of log files), and batch file encryption behaviors common in ransomware.

[0103] b) Network communication monitoring subroutine:

[0104] By using kprobe, it attaches to system calls such as sys_socket, sys_connect, sys_bind, sys_listen, and sys_accept, as well as kernel function entry points such as tcp_sendmsg and tcp_recvmsg. It captures events such as connection establishment, data sending / receiving, and connection closing in real time to accurately obtain the characteristic data (access frequency f, sent bytes b) needed to build a baseline of network connection behavior. out Receive byte b in Longest connection duration d max 90% connection time limit d p90 ).

[0105] Feature Construction and Anomaly Detection: eBPF initially aggregates events in kernel space and transmits them to the user-space dynamic metric agent. Within a rolling time window, the user-space controller calculates the aforementioned 5-dimensional feature vector x by target IP:Port. Subsequently, this feature vector x is transmitted to the Trusted Analysis Center for analysis. Based on the multivariate Gaussian distribution model established in process 1.3, the Trusted Analysis Center calculates the squared Mahalanobis distance. .like Exceeding the preset dynamic threshold of chi-square distribution If the network connection is abnormal, an alarm will be triggered.

[0106] Proactive defense: Integrates XDP or TC classifier eBPF programs to implement DDoS protection, traffic shaping, and inbound / outbound packet filtering and blocking at the network card driver layer or network protocol stack layer. Combines with cgroup / skb programs to implement process-based connection control. Detects and blocks database processes from connecting to predefined non-whitelisted IP addresses, unexpected ports, or high-risk geographically located IPs.

[0107] c) Process behavior monitoring subroutine: This subroutine uses kprobe to attach to system calls such as sys_execve, sys_clone, sys_fork, and sys_ptrace, and tracepoints to scheduling events such as sched / sched_process_exec and sched / sched_process_exit. Combined with kprobe attachments to memory management-related kernel function points, it detects abnormal child process creation, privilege escalation, memory injection, process hijacking (e.g., via LD_PRELOAD), and malicious code execution without files in real time.

[0108] d) Permission management monitoring subroutine: By attaching to permission-related system calls such as sys_setuid, sys_setgid, sys_setresuid, sys_chown, and sys_fchown via kprobe, it detects abnormal permission changes, privilege escalation attempts, and abuse of sudo or su behavior by database users or processes.

[0109] e) Memory Management Monitoring Subroutine: By deploying eBPF programs at the entry points of key memory management system calls such as sys_mprotect, sys_brk, sys_mmap, and sys_munmap, as well as related kernel functions (such as security_file_mprotect), fine-grained monitoring of database process memory operations is achieved. Specific monitoring content includes:

[0110] Memory page protection flag changes (mprotect): Real-time capture of setting, clearing, or modifying operations on critical protection flags such as PROT_EXEC (executable) and PROT_WRITE (writable). It focuses on detecting illegal PROT_WRITE additions (preparing for code injection) or PROT_EXEC additions (making the data segment executable, commonly seen in shellcode execution) to loaded code segment (.text) or read-only data segment (.rodata) memory regions.

[0111] Heap / Stack Memory Expansion (brk): Monitors the dynamic adjustment of heap and stack boundaries and detects abnormal large-scale heap / stack expansion behavior (which may indicate buffer overflow attack exploitation).

[0112] Memory map creation / destruction (mmap / munmap): Track the creation and destruction of anonymous maps (MAP_ANONYMOUS) or file maps, with particular attention to the creation of writable and executable memory regions with the PROT_EXEC | PROT_WRITE combined permissions, which is a typical feature of code injection attacks (such as JIT Spraying).

[0113] Key data structure access patterns: By combining process virtual memory region (VMA) information (which can be accessed via bpf_get_current_task(), task_struct->mm->mmap), monitor abnormal read and write patterns of specific sensitive memory regions (such as the process's task_struct structure, GOT / PLT table, and specific function pointers).

[0114] Through the above monitoring, the eBPF program can detect runtime memory injection attacks (such as code writing and modification of memory protection execution via ptrace or vulnerability exploitation), shellcode injection, and tampering with critical kernel or process data structures in real time.

[0115] f) Kernel integrity monitoring subroutine: It manages system calls and kernel functions by mounting to kernel modules such as init_module, delete_module, sys_init_module, and sys_delete_module via kprobe, and performs periodic integrity checks on key data structures that are relatively stable in kernel version iterations, such as the system call table and the kernel module list, to detect rootkit loading, kernel backdoors, driver hijacking, and tampering with key data structures (such as task_struct).

[0116] All monitoring subroutines utilize BPF_MAP_TYPE_PERF_EVENT_ARRAY or BPF_MAP_TYPE_RINGBUF to achieve zero-copy transfer of event data from kernel mode to user mode. Simultaneously, BPF_MAP_TYPE_PERCPU_ARRAY is used to store process context information, and BPF_MAP_TYPE_LRU_HASH is used to optimize status queries, ensuring sub-millisecond-level event capture and threat detection response capabilities. Through these optimizations, this invention is expected to keep the impact on core database performance within 5% under normal high-load database environments. For extremely high-load scenarios, an adaptive sampling mechanism or dynamic adjustment of monitoring granularity based on risk level can further balance security protection and performance overhead.

[0117] 3.2 Process Identification and Filtering

[0118] eBPF programs implement a multi-level, dynamic process identification and filtering mechanism:

[0119] a) Executable filename matching: In kernel space, the executable filename of the process is obtained through bpf_get_current_comm(), and then fuzzy or exact matching is performed with a preset list of database process keywords (such as "postgres", "mysqld").

[0120] b) Process ID whitelist maintenance: Dynamically maintain a whitelist mapping of type BPF_MAP_TYPE_HASH containing the IDs of the currently running database master process and all its legal child processes, and only process ID events within the whitelist are processed.

[0121] c) Parent-child process chain tracing: The complete parent-child process tree structure of the database process is constructed and traced using bpf_get_current_pid_tgid() and bpf_get_ppid() to ensure that all legitimate derived processes are included in the monitoring scope.

[0122] d) User identity verification: Obtain the user ID of the running process using bpf_get_current_uid_gid() and compare it with the database system's dedicated user (such as postgres, mysql).

[0123] e) Enhanced protection mechanisms:

[0124] i. Process binary file signature and integrity verification: When the process starts, the database core executable file is digitally signed and SM3 hashed for integrity verification.

[0125] ii. Isolation based on CGroup and namespace: Utilize Linux CGroup and Namespace technology to isolate database processes for resources and restrict the environment, preventing malicious processes from attacking or masquerading through shared resources.

[0126] 3.3 Event Capture and Preprocessing

[0127] When a mounted system call or kernel function is triggered, the eBPF program captures context information (such as register state and stack data) in kernel mode and constructs a standardized event structure. The event structure fields include event ID, event type, process ID, process thread group ID, parent process ID, executing user ID / group ID, timestamp, system call number, system call parameters (such as file descriptor, pathname, socket address), and call stack information. To further reduce the performance overhead of data transfer between user mode and kernel mode and user mode processing, the eBPF program performs rule-based event pre-filtering and aggregation processing in kernel mode; for example, it merges and counts frequently occurring events of the same type within a short period.

[0128] 3.4 Abnormal Behavior Detection

[0129] The eBPF program, in kernel-mode or user-mode dynamic measurement agent, performs a real-time sliding window comparison of captured events against a pre-loaded real-time behavior baseline model and a dynamic whitelist / blacklist. Detected anomalous behavior categories include:

[0130] a) Unauthorized access to sensitive files: Detects database processes performing openat, read, and write operations on non-database system files (such as / etc / shadow, / etc / passwd, / root / .ssh / authorized_keys), external USB device mount points, or unauthorized temporary directories.

[0131] b) Abnormal Network Connection Attempts: Based on the multivariate Gaussian distribution model and Mahalanobis distance calculation method described in Process 1.3, the Trust Analysis Center evaluates the network connection behavior of the database process in real time. If the squared Mahalanobis distance of the current network behavior feature vector... Exceeding the preset dynamic threshold of chi-square distribution If so, it is determined that the network connection is abnormal.

[0132] c) Abuse of dangerous system calls: Detect database processes executing system commands that should not be directly invoked in normal database operations, such as unlink (delete arbitrary files), rename (rename critical files), chmod (modify file permissions), and mknod (create device files), or attempt to use ptrace for process debugging / injection.

[0133] d) Behavioral sequence deviation detection: Based on the weighted LCS sequence pattern library established in process 1.3, the maximum WLCS similarity between the current system call sequence and the predefined trusted behavioral sequence pattern is evaluated in real time. The similarity threshold (For example, it is typically initialized to 0.85, and can be optimized based on ROC curve analysis of historical security logs) is used for judgment. If Below this statistical significance threshold If so, it is determined that the process execution sequence is abnormal.

[0134] For specific file system anomalies detected during dynamic monitoring (such as unauthorized write attempts to sensitive files), the Trusted Analysis Center can work with the static measurement agent to perform immediate and mandatory static integrity checks to confirm whether the files have been tampered with.

[0135] Process 4: Threat Analysis and Intelligent Response

[0136] 4.1 Multi-source information association

[0137] The Trusted Analysis Center receives file integrity anomaly alerts from the static measurement agent and runtime behavior anomalies from the dynamic measurement agent. Utilizing its built-in stream processing and correlation analysis engines, it performs multi-source information correlation analysis based on multiple dimensions, including time, process, file, and network factors.

[0138] a) Time window correlation: Analyze multiple related security events that occur within a preset time window (e.g., 5 seconds) to identify potential phased attack chains.

[0139] b) Process context association: Association analysis of multiple behavioral events executed at different times by the same process (process ID / thread group ID) or process groups derived from the same parent process.

[0140] c) File object association: Association analysis analyzes multiple operation events that occur on the same file (identified by inode or absolute path) or a logically related set of files (such as the database main program and its configuration file).

[0141] d) Network Session Correlation: Correlation analysis of network connection patterns and data transmission behavior based on specific source / destination IPs, ports, protocols (such as TCP / UDP), and data traffic characteristics.

[0142] 4.2 Threat Level Assessment

[0143] The strategy decision-making subsystem calculates a standardized threat level based on assessment dimensions from the threat analysis report, including threat type, attack confidence level, potential impact scope, and the business criticality of the threatened assets. This is achieved through weighted summation combined with the confidence level of anomaly detection. The threat level is divided into five levels:

[0144] a) Information level: Minor anomalies or audit events will only be recorded in detailed audit logs and will not trigger active alarms.

[0145] b) Low-risk level: Non-critical abnormal behavior, generates low-priority alarm notifications, but does not block business operations.

[0146] c) Medium risk level: Potential risky behavior, generate medium priority alarm, and recommend manual intervention for investigation and confirmation.

[0147] d) High-risk level: If identified as a serious threat or malicious attack, automatically execute preset proactive protection actions (such as blocking connections and isolating files).

[0148] e) Severity level: System-level serious threat or intrusion has occurred. Immediately implement the strictest emergency response measures, such as isolation, blocking, and evidence collection.

[0149] 4.3 Response Strategy Matching

[0150] The strategy decision-making subsystem matches and selects the optimal response strategy from a configurable dynamic strategy library based on the threat type (such as file tampering and code injection) and the assessed threat level in the threat analysis results. The response strategy adopts rules in the form of IF-THEN-ELSE (such as IF (threat type == code injection AND threat level == severity) THEN(terminate process, isolate host)), supports complex logical conditions of AND / OR combinations, regular expression matching, and serialization or parallel execution of various atomic response actions.

[0151] 4.4 Automated Response Execution

[0152] The protection agent receives protection commands with digital signatures (to prevent tampering) issued by the Trusted Analysis Center through a secure channel (such as an RPC call based on the national cryptographic TLS protocol) and automatically executes the corresponding response actions. The response actions include:

[0153] a) Alarm notification: Send detailed alarm information via email, SMS gateway API, or integration into instant messaging platforms such as WeChat / DingTalk.

[0154] b) Access Control: The eBPF program can block outbound network connections initiated by the database process in kernel mode (via BPF_SKB_DROP). For inbound connections, the XDP eBPF program integrated in the dynamic metrics agent implements packet filtering and dropping at the network card driver layer, providing early and efficient inbound attack blocking capabilities. Additionally, file access permissions can be modified using the operating system's chmod / chown commands.

[0155] c) Process intervention: Terminate the malicious process using the kill() system call, or restart the affected database service using the systemd / service command.

[0156] d) System isolation: Disconnect all network connections to the host using the command `ip route del default` or `systemctl stop`.<db_service> Commands can stop database services and even isolate virtual machines via virtualization platform APIs.

[0157] e) Evidence Preservation and Collection: The system can automatically trigger and save lightweight forensic information, such as system logs, audit logs, and network packet metadata. For resource-intensive or deep forensic operations that may affect business performance, the system will generate detailed operation instructions and issue alerts. These instructions will be reviewed by the security administrator, who will then make a decision and execute them manually to avoid impacting the business performance of the production environment.

[0158] Process 5: Autonomous Recovery

[0159] 5.1 Determining Recovery Conditions

[0160] After the security policy executor performs blocking, isolation, and other response actions, the Trusted Analysis Center will continuously monitor the status of the affected database system. When the threat is confirmed to be eliminated (e.g., the malicious process has been terminated, the tampered file has been isolated, and no new abnormal events have occurred within a specified time window), or when the security administrator manually confirms that the threat has been resolved, the system will trigger an autonomous recovery process.

[0161] 5.2 Recovery Strategy Selection

[0162] Based on the initial threat level, the type of affected asset, and the predefined recovery strategy, select the appropriate recovery operation. The recovery strategy library includes several preset recovery options, such as:

[0163] a) Service restart: For availability issues caused by process crashes or temporary resource exhaustion, try restarting the service using `systemctl restart`.<db_service> The command restarts the database service.

[0164] b) File Rollback: In cases where file integrity has been compromised, the tampered file is recovered from a trusted backup that has been encrypted and digitally signed and stored on a remote, secure medium. This trusted backup is created by the Static Metrics Agent when the system is in a 'known secure' state, and its SM3 hash is simultaneously calculated and stored in the Trusted Analysis Center. This process requires the Static Metrics Agent's cooperation to ensure that the recovered file's SM3 hash matches the baseline value. The Trusted Analysis Center will periodically perform integrity verification on the backup source to ensure the reliability of the backup data itself.

[0165] c) Network connection restoration: If the system experiences service interruption due to network isolation, the network connection of the database server can be restored by using the ip routeadddefault command or by configuring firewall rules.

[0166] d) Configuration recovery: If the configuration file is tampered with, it will be automatically rolled back from a historical trusted configuration version.

[0167] 5.3 Recovery Operation Execution

[0168] The security policy executor issues recovery commands to the protection agent of the computing system. Based on the commands, the protection agent calls the corresponding operating system APIs or scripts to perform the recovery operation. For example, if the database service needs to be restarted, `sudo systemctl restart postgresql` is executed; if files need to be restored, `cp / var / db_backup / pg_hba.conf / etc / postgresql / 13 / main / pg_hba.conf` is executed and permissions are checked.

[0169] 5.4 Recovery Result Verification and Status Synchronization

[0170] After the recovery operation is complete, the static and dynamic measurement agents will immediately perform integrity re-measurement and behavior monitoring, and report the recovered system status to the Trusted Analysis Center. The Trusted Analysis Center verifies whether the integrity of all critical files has been restored, whether the database process behavior has returned to the baseline range through the dynamic behavior baseline model verification, and whether business functions have been restored to availability. Upon successful verification, the system status is updated to "Safe / Normal Operation" and relevant alarm information is cleared.

Claims

1. A database self-protection system based on a dual-architecture system, characterized in that, include: Computing architecture: It carries the core business logic of the database, including the database main process, client tools, upper-layer business applications, and static measurement agents, dynamic measurement agents, and protection agents deployed on the database server; Protection system: responsible for security monitoring, analysis, decision-making and response, including independently deployed trusted analysis center, security policy executor, and hardware root of trust TCM and corresponding software stack that provide a trusted foundation.

2. The database self-protection system based on a dual-architecture system according to claim 1, characterized in that, The core components include: a) Static Measurement Agent: Deployed in the user space of the database server, it performs integrity hash value measurement based on the SM3-256 algorithm on key static files related to the database, thereby realizing the reliable verification of the integrity of static assets of the computing system; b) Dynamic Measurement Agent: Implemented as a collection of eBPF programs loaded into the Linux kernel and user-space agent programs; the user-space controller is responsible for interacting with the kernel-space eBPF programs to perform event data interaction, preliminary filtering and aggregation, and feature preprocessing, and then reporting the processed events to the Trusted Analysis Center for advanced modeling and analysis. c) Protection Proxy: Implemented as an independent thread or module within the user-mode controller process of the dynamic measurement proxy, it receives instructions through an internal message queue, avoiding the overhead and complexity of inter-process communication (IPC). The protection proxy is responsible for receiving protection instructions issued by the security policy executor and calling the operating system interface to execute the corresponding security response actions. d) Trusted Analysis Center: Deployed on a separate security management server; e) Security Policy Executor: As a lower-level module of the Trusted Analysis Center, it is responsible for receiving threat analysis reports generated by the Trusted Analysis Center, conducting threat level assessments and matching response strategies, and sending specific protection instructions to the protection agents in the computing system through a secure communication channel. f) Hardware Trust Root (TCM) and TPCM (Software and Hardware): By expanding the measurement scope of the hardware trust root, the user-mode controller programs of the static and dynamic measurement agents, as well as the SM3 hash values ​​of the eBPF bytecode files they load, are incorporated into the measurement chain of the platform configuration register (PCR). Through a remote verification protocol based on SM2 digital signatures, the code of the protection components in the current computing system is verified to the Trust Analysis Center to ensure that it has not been tampered with.

3. A database autonomous protection method based on a dual-architecture system using the system described in claim 2, characterized in that, The specific implementation steps of this method are as follows: Phase 1: Establishing a Trusted Benchmark; In a trusted environment, the static metrics agent calculates the SM3-256 hash value for all critical files in the database, uploads it as a static trusted baseline, and securely stores it in the trusted analysis center; the dynamic metrics agent loads the eBPF program and enters baseline learning mode. Behavioral baseline learning should be conducted during a known security phase after the database system is deployed but before the official business goes live, or in a thoroughly audited and isolated test environment by replaying normal business traffic. During this phase, data on system call sequences, network connections, and file access behavior should be collected. A normal behavioral baseline model of the database system should be established using multivariate statistical methods and sequence analysis and stored in the behavioral baseline database of the Trusted Analysis Center. Phase Two: Runtime Monitoring and Intelligent Response; Static monitoring: The static measurement agent verifies the consistency between the file's SM3 hash value and the baseline value through multiple triggering modes, and immediately alerts and responds when tampering is detected; Dynamic monitoring: The dynamic measurement agent continuously monitors the runtime behavior of the database process through the eBPF program. Through kernel-mode filtering and user-mode analysis, it compares events with the behavior baseline in real time to detect abnormal deviations. Correlation Analysis and Response: The Trusted Analysis Center performs multi-source correlation analysis on dynamic and static alarm events, assesses the threat level, and matches preset response strategies based on the detection results; The security policy executor sends instructions to the protection agent to execute automated response actions.

4. The database self-protection method based on a dual-architecture system as described in claim 3, characterized in that, The dual-architecture initialization and baseline establishment process of this method is as follows: S1 dual-system architecture deployment; Deploy system components according to the Trusted Computing 3.0 dual-architecture concept; a) Computing architecture: Deploy database system instances, database management interface web application, static measurement agent, dynamic measurement agent user-mode controller, and protection agent; static measurement agent and dynamic measurement agent are deployed locally on the database server as front-end agents; b) Protection system: Integrate the hardware root of trust (TCM) and corresponding software components, deploy the Trusted Analysis Center and Security Policy Executor as backend services on an isolated security management server; c) eBPF environment preparation: Check the Linux kernel version of the target operating system to ensure full support for the required features of eBPF, and install the eBPF development and runtime dependency libraries; S2 static baseline value establishment; The static metrics agent recursively scans all binary files, configuration files, and library files related to database operation in the database directory based on a pre-defined strategy configuration file written in Yaml; for each scanned file, its 256-bit SM3 hash value is calculated using the national cryptographic SM3-256 algorithm. S3 Dynamic Behavior Baseline Establishment and Model Construction; Load and activate the eBPF dynamic monitor, putting it into behavior baseline learning mode; the eBPF dynamic monitor is precisely mounted to the following kernel locations: a) System call entry points: sys_execve, sys_connect, sys_openat, sys_read, sys_write, sys_mmap are system calls related to process execution, network communication, file access, and memory management; b) Kernel function trace point kprobe: Deeply monitors the execution paths of kernel functions such as process execution do_execveat_common, network communication tcp_connect, tcp_sendmsg, and file access vfs_read, vfs_write; c) Tracepoint events: mounted to kernel static tracepoints such as sched / sched_process_exec and filemap / filemap_read_pages; To ensure the relevance and purity of the collected data, a multi-layered filtering mechanism is implemented in kernel mode: First, the executable file name of the current process is obtained through the bpf_get_current_comm() function for preliminary filtering; then, the process derivation relationship graph is established by recursively tracing its parent process chain; finally, only behavioral events related to the database main process and all its directly or indirectly derived child / worker processes are captured. Behavioral data flowing into the real-time stream processing engine is transformed into network connection behavior features and process execution sequence features through the feature engineering module. Simultaneously, a multimodal modeling strategy integrating Multivariate Statistical Process Control (MSPC) and intelligent sequence alignment is employed to construct a dynamic behavioral baseline for the database system. a) Network connectivity behavior baseline: For network connectivity behavior, the connectivity characteristics of a specific target IP:Port within a rolling time window are modeled; b) Process behavior baseline: For process execution behavior, the system call sequence is divided into K-gram sliding window segments to generate continuous fixed-length sequence segments.

5. A database self-protection method based on a dual-architecture system as described in claim 3, characterized in that, The runtime static integrity measurement process of this method is as follows: S1, trigger condition detection; Static metric proxy supports multiple triggering modes: a) Forced verification before startup: Before the database service is officially started, the ExecStartPre hook when the systemd service is managed is used to automatically trigger the integrity verification of critical binary and configuration files to ensure that the basic environment before the service starts is trustworthy. b) Periodic timed verification: Use cron jobs or internal timer mechanisms to periodically check the integrity of critical files at preset time intervals; c) Event-driven verification: Utilizes the Linux kernel inotify mechanism to monitor critical database file directories in real time, triggering immediately when file creation, modification, or deletion events occur; d) Manually triggered verification: initiated by the administrator; S2, File integrity calculation; For each file to be verified, the static metrics agent calls the same SM3 algorithm as in the baseline establishment phase to recalculate its cryptographic hash value; To optimize the performance of integrity measurement for large files, asynchronous I / O block reading of files and SM3 streaming update calculation are adopted; S3, benchmark comparison; The currently calculated SM3 hash value is compared byte-level precisely with the baseline value of the corresponding file securely obtained from the baseline value library of the Trusted Analysis Center; if the SM3 hash values ​​match completely, a successful verification event log is recorded; if they do not match, a high-priority file integrity anomaly alarm is immediately generated, and the alarm content includes the file path, the actual content hash of the tampered file, the baseline hash, the detection timestamp, and the file metadata. S4, Response Action Execution; Execute the corresponding actions according to the preset security response strategy: a) Alarm notification: Send real-time alarms to security administrators via email, SMS gateway API, or integrated SIEM system; b) Service blocking: If the detection is performed at startup, the database service process will be prevented from starting through systemd unit file configuration or script logic; c) File isolation: Move the tampered file to the preset secure isolation directory and change its access permissions to 000; d) Service degradation: Temporarily restrict specific functions of the database by modifying database configuration files or firewall rules.

6. The database self-protection method based on a dual-architecture system according to claim 5, characterized in that, The implementation process of runtime dynamic behavior monitoring is as follows: S1, eBPF program loading and mounting; The user-space controller of the dynamic metrics agent loads the compiled eBPF program into the kernel; the collection of eBPF programs contains multiple monitoring subroutines: a) File system operation monitoring subroutine: By using kprobe to mount to the sys_openat, sys_read, sys_write, sys_unlinkat, and sys_renameat system calls, and tracepoint to mount to the ext4_file_open file system event, it can detect unauthorized access to sensitive database files, malicious I / O operations, and the batch file encryption behavior commonly seen in ransomware in real time. b) Network communication monitoring subroutine: The kprobe is used to attach to sys_socket, sys_connect, sys_bind, sys_listen, sys_accept, as well as tcp_sendmsg and tcp_recvmsg; real-time capture of connection establishment, data sending / receiving, and connection closing is achieved. Feature construction and anomaly detection: eBPF initially aggregates events in kernel space and transmits them to the user-space dynamic measurement agent; Within the rolling time window, the user-mode controller calculates the feature vector x according to the target IP:Port; Subsequently, the feature vector x is transmitted to the Trusted Analysis Center for analysis; Active defense: Integrates XDP or TC classifier eBPF programs to implement DDoS protection, traffic shaping, inbound / outbound packet filtering and blocking at the network card driver layer or network protocol stack layer; combines cgroup / skb programs to implement process-based connection control; detects and blocks database processes from connecting to predefined non-whitelisted IP addresses, unexpected ports or high-risk geographical location IPs; c) Process behavior monitoring subroutine: By attaching kprobe to the sys_execve, sys_clone, sys_fork, and sys_ptrace system calls, and by attaching tracepoints to the sched / sched_process_exec and sched / sched_process_exit scheduling events; combined with kprobe attaching to kernel function points related to memory management, it can detect abnormal child process creation, privilege escalation, memory injection, process hijacking, and malicious code execution without files in the database process in real time; d) Permission management monitoring subroutine: By mounting the system calls related to permissions such as sys_setuid, sys_setgid, sys_setresuid, sys_chown, and sys_fchown via kprobe, it detects abnormal permission changes, privilege escalation attempts, and abuse of sudo or su behavior by database users or processes; e) Memory management monitoring subroutine: By deploying eBPF programs at the entry points of key memory management system calls and related kernel functions such as sys_mprotect, sys_brk, sys_mmap, and sys_munmap, fine-grained monitoring of database process memory operations can be achieved. f) Kernel integrity monitoring subroutine: By mounting the kernel modules to init_module, delete_module, sys_init_module, and sys_delete_module via kprobe, it manages system calls and kernel functions, as well as periodically checks the integrity of key data structures such as the system call table and kernel module list that are relatively stable in kernel version iterations, to detect rootkit loading, kernel backdoors, driver hijacking, and tampering with key data structures. All monitoring subroutines utilize BPF_MAP_TYPE_PERF_EVENT_ARRAY or BPF_MAP_TYPE_RINGBUF to achieve zero-copy transfer of event data from kernel mode to user mode; at the same time, BPF_MAP_TYPE_PERCPU_ARRAY is used to store process context information and BPF_MAP_TYPE_LRU_HASH is used to optimize status queries, ensuring sub-millisecond-level event capture and threat detection response capabilities; S2, process identification and filtering; eBPF programs implement a multi-level, dynamic process identification and filtering mechanism: a) Executable filename matching: In kernel mode, the executable filename of the process is obtained through bpf_get_current_comm(), and then fuzzy or exact matching is performed with the preset database process keyword list; b) Process ID whitelist maintenance: Dynamically maintain a whitelist mapping of type BPF_MAP_TYPE_HASH containing the IDs of the currently running database master process and all its legal child processes, and only process ID events within the whitelist are processed; c) Parent-child process chain tracing: The complete parent-child process tree structure of the database process is constructed and traced using bpf_get_current_pid_tgid() and bpf_get_ppid() to ensure that all legitimate derived processes are included in the monitoring scope; d) User identity verification: Obtain the user ID of the running process using bpf_get_current_uid_gid() and compare it with the dedicated user ID of the database system; e) Enhanced protection mechanisms: i. Process binary file signature and integrity verification: When the process starts, the database core executable file is digitally signed and SM3 hashed for integrity verification. ii. Isolation based on CGroup and namespace: Utilize Linux CGroup and Namespace technology to isolate database processes for resources and restrict the environment, preventing malicious processes from attacking or masquerading through shared resources; S3, event capture and preprocessing; When a mounted system call or kernel function is triggered, the eBPF program captures context information in kernel mode and constructs a standardized event structure. The event structure fields include event ID, event type, process ID, process thread group ID, parent process ID, executing user ID / group ID, timestamp, system call number, system call parameters, and call stack information. The eBPF program performs rule-based event pre-filtering and aggregation processing in kernel mode. S4, Abnormal Behavior Detection: In the kernel-mode or user-mode dynamic measurement agent, the eBPF program compares the captured events with the pre-loaded real-time behavior baseline model and dynamic whitelist / blacklist in a real-time sliding window. For specific file system abnormal behaviors detected in dynamic monitoring, the Trusted Analysis Center can link with the static measurement agent to perform immediate and mandatory static integrity checks to confirm whether the file has been tampered with.

7. A database self-protection method based on a dual-architecture system as described in claim 6, characterized in that, The process of threat analysis and intelligent response is as follows: S1, Multi-source Information Association; The Trusted Analysis Center receives file integrity anomaly alarms from the static measurement agent and runtime behavior anomaly events from the dynamic measurement agent. Utilizing its built-in stream processing engine and association analysis engine, it performs multi-source information association analysis based on multiple dimensions such as time, process, file, and network. S2, Threat Level Assessment; The strategy decision-making subsystem calculates the standardized threat level based on the assessment dimensions in the threat analysis report, such as threat type, attack confidence, potential impact scope, and business criticality of the threatened assets, using a weighted summation and combining the confidence of anomaly detection. S3, Response Strategy Matching: The strategy decision subsystem matches and selects the optimal response strategy from a configurable dynamic strategy library based on the threat type and assessed threat level in the threat analysis results. The response strategy adopts the IF-THEN-ELSE rule THEN, which supports complex logical conditions combining AND / OR, regular expression matching, and the serialization or parallel execution of various atomic response actions. S4, automated response execution; The protection agent receives digitally signed protection commands issued by the Trusted Analysis Center through a secure channel and automatically executes the corresponding response actions; the response actions include: a) Alarm notification: Send detailed alarm information via email, SMS gateway API, or integration into instant messaging platforms such as WeChat / DingTalk; b) Access control: eBPF programs can block outbound network connections initiated by database processes in kernel mode; for inbound connections, packet filtering and dropping are implemented at the network card driver layer through the XDPeBPF program integrated in the dynamic measurement agent; file access permissions can be modified through the operating system's chmod / chown commands. c) Process intervention: Terminate the malicious process using the kill() system call, or restart the affected database service using the systemd / service command; d) System isolation: Disconnect all network connections to the host using the `iproutedeldefault` command or `systemctl stop`.<db_service> Commands can be used to stop database services and even isolate virtual machines via virtualization platform APIs; e) Evidence preservation and collection: Automatically trigger and save lightweight evidence collection information; for resource-intensive or deep evidence collection operations that may affect business performance, generate detailed operation instructions and alarms, which are then reviewed and decided upon by the security administrator and manually executed to avoid impacting the business performance of the production environment.

8. A database self-protection method based on a dual-architecture system as described in claim 7, characterized in that, The self-recovery process is as follows: S1 Recovery Condition Judgment; After the security policy executor performs blocking, isolation, and other response actions, the Trusted Analysis Center will continuously monitor the status of the affected database system. When the threat is confirmed to be eliminated, or the security administrator manually confirms the removal of the threat, the system will trigger an autonomous recovery process. S2 recovery strategy selection: Select the recovery operation based on the initial threat level, the type of affected asset, and the predefined recovery strategy; S3 recovery operation is executed; the security policy executor issues a recovery command to the protection agent of the computing system; the protection agent calls the corresponding operating system API or script to execute the recovery operation according to the command; S4 recovery result verification and status synchronization; after the recovery operation is completed, the static measurement agent and dynamic measurement agent will immediately perform integrity re-measurement and behavior monitoring, and feed back the recovered system status to the Trusted Analysis Center; The Trusted Analysis Center verifies whether the integrity of all critical files has been restored to normal, whether the database process behavior has passed the verification of the dynamic behavior baseline model and regressed to the baseline range, and whether business functions have been restored to availability; After successful verification, the system status will be updated to safe / normal operation, and relevant alarm information will be cleared.

Images