A database operation log risk early warning method and system

Abstract

The application provides a database operation log risk early warning method and system, the method comprises the following steps: configuring a language model; integrating a configuration file, the configuration file comprises executing an SQL statement to query data, managing a system disk file, and sending an email; inputting user requirements, forming user instructions based on the user requirements, and issuing an execution task according to the user instructions; querying dangerous data from a database based on the execution task and the language model and the execution SQL statement to query data, and analyzing the database based on the language model; generating an HTML report through the management system disk file and the dangerous data, and sending the HTML report to a preset address based on email sending. The application can significantly improve the accuracy of rule matching, achieve the purpose of rapid communication notification, and effectively reduce the cost of timely responding to business needs.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a method and system for risk warning of database operation logs. Background Technology

[0002] Current risk analysis systems based on database operation logs primarily rely on manually preset static rules, which has significant limitations. Administrators need to predefine the criteria for judging various risky operations, including data leakage risk operations, login behavior at abnormal times, and data loss risk operations. This approach leads to two problems: First, rule configuration is labor-intensive, requiring the classification of various operation commands one by one, and continuous updates and maintenance are needed as business develops; second, static rules have limited coverage, making it difficult to identify variant attacks or new threats outside the rule base.

[0003] In terms of risk presentation, existing solutions suffer from rigid architecture. Risk identification results are tightly coupled with front-end display, requiring separate development of visualization modules for each risk type. Alarm mechanisms also lack flexibility; integration with notification channels such as email and SMS requires repetitive coding and cannot quickly adapt to new notification methods like enterprise instant messaging tools. This technical architecture results in high system maintenance costs and makes it difficult to respond promptly to changes in business security needs. Summary of the Invention

[0004] Therefore, the purpose of this invention is to provide a database operation log risk warning method and system to overcome the shortcomings of the prior art.

[0005] In a first aspect, the present invention provides a database operation log risk warning method, the method comprising:

[0006] Configure the language model;

[0007] The configuration file is integrated, which includes functions for executing SQL statements to query data, managing system disk files, and sending emails.

[0008] Input user requirements, formulate user instructions based on the user requirements, and issue execution tasks according to the user instructions;

[0009] Based on the execution task and the language model, dangerous data is retrieved from the database using the executed SQL statement, and the database is analyzed based on the language model.

[0010] An HTML report is generated using the system's disk files and the dangerous data, and the HTML report is sent to a preset address via email.

[0011] Compared with the prior art, the beneficial effects of the present invention are as follows: by configuring an integrated file and querying data through the SQL statements in the integrated file, combined with a language model, dangerous data can be queried from the database. This enables the parsing of user requirements to generate standardized SQL query statements for querying, significantly improving the accuracy of rule matching. By managing the system disk files, HTML reports can be flexibly generated and sent to a preset address via email, achieving the purpose of rapid communication and notification, and effectively reducing the cost of timely response to business needs.

[0012] Furthermore, the step of configuring the language model includes:

[0013] Import the cline plugin from VS Code and configure the language model based on the cline plugin.

[0014] Furthermore, after the integration configuration file includes steps such as executing SQL statements to query data, managing system disk files, and sending emails, the method further includes:

[0015] Configure a log analysis library in the SQL query query process, wherein the log analysis library contains a database operation log table.

[0016] Furthermore, the step of querying dangerous data from the database based on the execution task, the language model, and the executed SQL statement includes:

[0017] Based on the execution task and the language model, retrieve risky operation records from the database;

[0018] The execute_sql tool, which executes SQL statements to query data, and the db_operation_log table are used to query dangerous data.

[0019] Furthermore, the step of analyzing the database based on the language model includes:

[0020] Based on the language model, the structure of all tables in the database and the definitions of their fields are analyzed in order to query and statistically analyze the data in the database.

[0021] Secondly, the present invention also provides a database log risk early warning system, the system comprising:

[0022] The configuration module is used to configure the language model;

[0023] The integration module is used to integrate configuration files, which include executing SQL statements to query data, managing system disk files, and sending emails.

[0024] The input module is used to input user needs, formulate user instructions based on the user needs, and issue execution tasks according to the user instructions;

[0025] The query module is used to query dangerous data from the database based on the execution task, the language model, and the executed SQL statement, and to analyze the database based on the language model.

[0026] The generation module is used to generate an HTML report using the system disk files and the dangerous data, and send the HTML report to a preset address based on the email sending.

[0027] Furthermore, the configuration module includes:

[0028] A configuration unit for importing the cline plugin from VS Code and configuring the language model based on the cline plugin.

[0029] Furthermore, the query module includes:

[0030] The acquisition unit is used to acquire risky operation records from the database based on the execution task and the language model;

[0031] The query unit is used to query dangerous data based on the execute_sql tool that executes the SQL statement to query data and the db_operation_log table.

[0032] Thirdly, the present invention also provides a readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-described database operation log risk warning method.

[0033] Fourthly, the present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the above-described database operation log risk warning method. Attached Figure Description

[0034] To more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0035] Figure 1 This is a flowchart of the database operation log risk warning method in the first embodiment of the present invention;

[0036] Figure 2 This is a structural block diagram of the database operation log risk warning system in the second embodiment of the present invention;

[0037] Figure 3 This is a structural block diagram of a computer device according to the third embodiment of the present invention.

[0038] Explanation of key component symbols:

[0039] 11. Configuration module; 12. Integration module; 13. Input module; 14. Query module; 15. Generation module;

[0040] 10. Memory; 20. Processor; 30. Computer program.

[0041] The embodiments of the present invention will be further described below with reference to the accompanying drawings. Detailed Implementation

[0042] To facilitate understanding of the present invention, a more complete description will be given below with reference to the accompanying drawings. Several embodiments of the invention are illustrated in the drawings. However, the invention can be implemented in many different forms and is not limited to the embodiments described herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete.

[0043] It should be noted that when a component is said to be "fixed to" another component, it can be directly on the other component or there may be an intervening component. When a component is said to be "connected to" another component, it can be directly connected to the other component or there may be an intervening component. The terms "vertical," "horizontal," "left," "right," and similar expressions used in this document are for illustrative purposes only.

[0044] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. The terminology used herein in the description of the invention is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. The term "and / or" as used herein includes any and all combinations of one or more of the associated listed items.

[0045] Example 1

[0046] Please see Figure 1 The figure shows a database operation log risk warning method in the first embodiment of the present invention, the method including steps S1 to S5:

[0047] S1, Configure the language model;

[0048] Specifically, step S1 includes step S11:

[0049] S11, Import the cline plugin from VS Code and configure the language model based on the cline plugin;

[0050] It should be explained that in this embodiment, the cline plugin is used to make imperative requests based on natural language. Therefore, the cline plugin is introduced into VS Code, providing an entry point for integrating Deepseek chat and Deepseek R1. It should also be noted that the language model used in this embodiment is Deepseek.

[0051] S2, integrate the configuration file, which includes executing SQL statements to query data, managing system disk files, and sending emails;

[0052] Specifically, step S2 includes step S21:

[0053] S21, Configure a log analysis library in the data query of the executed SQL statement, wherein the log analysis library contains a database operation log table;

[0054] It should be explained that in order to implement user commands without writing code, an MCP server is needed. In this embodiment, three MCPs are integrated, including operateMySQL (execute SQL statements to query data), desktop-commander (manage system disk files), and resend (send emails). Among them, a log analysis library is configured in operateMySQL, and there is a database operation log table in the log analysis library.

[0055] S3, Input user requirements, formulate user instructions based on user requirements, and issue execution tasks according to user instructions;

[0056] Understandably, user needs are input and commands are formed to flexibly execute various tasks. For example, if a user is concerned about database security, they can input queries such as "export" or "delete" to indicate data leakage risks or data deletion, and then import the retrieved data into HTML.

[0057] S4. Based on the execution task and the language model and the execution SQL statement, query dangerous data from the database, and analyze the database based on the language model;

[0058] Specifically, step S4 includes steps S41 to S43:

[0059] S41, based on the execution task and the language model, retrieve risky operation records from the database;

[0060] S42, based on the execute_sql tool and the db_operation_log table, execute a query for dangerous data;

[0061] Understandably, tasks generated based on user needs retrieve risky operation records from the database. According to the environment details, the OperateMySQL server provides the `execute_sql` tool and has a `db_operation_log` table; an SQL query should be executed to retrieve the data.

[0062] S43, Analyze the structure of all tables in the database and their field definitions based on the language model, so as to query and statistically analyze the data in the database;

[0063] It's important to explain that, leveraging Deepseek's powerful reasoning capabilities, it automatically analyzes the structure of all tables and their field definitions in the database. It can not only query for database operation risks, but also perform queries and statistics on any data present in the database. It's also a small, intelligent data analysis system, and the data can be displayed not only in tables, but also in statistical reports and all chart types supported by Echars.

[0064] S5, generate an HTML report using the system disk files and the dangerous data, and send the HTML report to a preset address based on the email sending;

[0065] It needs to be explained that generating an HTML report requires the following: file path (the user requires the D:\alert log file directory, so the path must be correct); HTML template (a well-designed report template containing tables needs to be created); data binding (the query results need to be dynamically populated into the HTML tables); and email sending requirements (the recipient's address must be specified; the email content must include an HTML attachment or embedded HTML content).

[0066] In summary, the database operation log risk warning method in the above embodiments of the present invention involves a complex and time-consuming process of database operation security analysis and final presentation. Different users have different needs and concerns. However, based on Deepseek large model technology, relying on large model reasoning and analysis to determine the user's true needs, and combining various MCPs, the method automatically presents the data needed by the user without any manual cost. In the future, it can be expanded to call other MCPs, with endless functionality. It can meet the query and statistics of different users for various dimensions and rules of database operation risks based on the natural language input of the user. This allows for an intelligent risk warning result that meets the needs of all users and conforms to the final rules, automatically and conveniently providing users with a result that conforms to the final rules without developing a single line of code.

[0067] Example 2

[0068] Please see Figure 2 The figure shows a database log risk warning system according to a second embodiment of the present invention. The system includes:

[0069] Configuration module 11 is used to configure the language model;

[0070] Integration module 12 is used to integrate configuration files, which include executing SQL statements to query data, managing system disk files, and sending emails;

[0071] The input module 13 is used to input user needs, construct user instructions based on the user needs, and issue execution tasks according to the user instructions;

[0072] The query module 14 is used to query dangerous data from the database based on the execution task, the language model, and the executed SQL statement, and to analyze the database based on the language model.

[0073] The generation module 15 is used to generate an HTML report using the system disk files and the dangerous data, and send the HTML report to a preset address based on the email sending.

[0074] In some alternative embodiments, the configuration module 11 includes:

[0075] A configuration unit for importing the cline plugin from VS Code and configuring the language model based on the cline plugin.

[0076] In some alternative embodiments, the integration module 12 includes:

[0077] The configuration unit is used to configure the log analysis library in the data queried by executing the SQL statement, wherein the log analysis library contains a database operation log table.

[0078] In some alternative embodiments, the query module 14 includes:

[0079] The acquisition unit is used to acquire risky operation records from the database based on the execution task and the language model;

[0080] The query unit is used to query dangerous data based on the execute_sql tool that executes the SQL statement to query data and the db_operation_log table;

[0081] The analysis unit is used to analyze the structure of all tables and their field definitions in the database based on the language model, so as to query and statistically analyze the data in the database.

[0082] The functions or operation steps implemented by the above modules and units are largely the same as those in the above method embodiments, and will not be repeated here.

[0083] The database log risk warning system provided in this embodiment of the invention has the same implementation principle and technical effects as the aforementioned method embodiment. For the sake of brevity, any parts not mentioned in the system embodiment can be referred to the corresponding content in the aforementioned method embodiment.

[0084] Example 3

[0085] The present invention also proposes a computer device, please refer to [link / reference]. Figure 3 The diagram shows a computer device according to a third embodiment of the present invention, including a memory 10, a processor 20, and a computer program 30 stored on the memory 10 and executable on the processor 20. When the processor 20 executes the computer program 30, it implements the above-described database log risk warning method.

[0086] The memory 10 includes at least one type of readable storage medium, such as flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory 10 may be an internal storage unit of a computer device, such as the hard disk of that computer device. In other embodiments, the memory 10 may be an external storage device, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. Furthermore, the memory 10 may include both internal and external storage units of the computer device. The memory 10 can be used not only to store application software and various types of data installed on the computer device, but also to temporarily store data that has been output or will be output.

[0087] In some embodiments, the processor 20 may be an electronic control unit (ECU), a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip, used to run program code stored in the memory 10 or process data, such as executing access restriction programs.

[0088] It should be pointed out that, Figure 3 The structure shown does not constitute a limitation on the computer device. In other embodiments, the computer device may include fewer or more components than shown, or combine certain components, or have different component arrangements.

[0089] This invention also proposes a readable storage medium storing a computer program that, when executed by a processor, implements the database log risk warning method described above.

[0090] Those skilled in the art will understand that the logic and / or steps represented in the flowcharts or otherwise described herein, for example, can be considered as a sequential list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can mean any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0091] More specific examples of computer-readable media (a non-exhaustive list) include: electrical connections (electronic devices) having one or more wires, portable computer disk drives (magnetic devices), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Furthermore, computer-readable media can even be paper or other suitable media on which the program can be printed, because the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in computer memory.

[0092] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0093] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0094] The embodiments described above are merely illustrative of several implementations of the present invention, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these all fall within the protection scope of the present invention. Therefore, the protection scope of this invention patent should be determined by the appended claims.

Claims

1. A database operation log risk early warning method, characterized in that, The method includes: Configuring the language model specifically includes the following steps: Import the Cline plugin from VS Code and configure the language model based on the Cline plugin; The integration configuration file, which includes functions for executing SQL statements to query data, managing system disk files, and sending emails, specifically includes the following steps: Configure a log analysis library in the SQL statement query data execution, wherein the log analysis library contains a database operation log table; Input user requirements, formulate user instructions based on the user requirements, and issue execution tasks according to the user instructions; Based on the execution task and the language model, dangerous data is retrieved from the database using the executed SQL statement. The database is then analyzed based on the language model. This step specifically includes: Based on the execution task and the language model, retrieve risky operation records from the database; The execute_sql tool and the db_operation_log table are used to query dangerous data. An HTML report is generated using the system's disk files and the dangerous data, and the HTML report is sent to a preset address via email.

2. The database operation log risk warning method according to claim 1, characterized in that, The steps of analyzing the database based on the language model include: Based on the language model, the structure of all tables in the database and the definitions of their fields are analyzed in order to query and statistically analyze the data in the database.

3. A database log risk early warning system, characterized in that, The system includes: The configuration module is used to configure the language model; The configuration module includes: A configuration unit for importing the Cline plugin from VS Code and configuring the language model based on the Cline plugin; The integration module is used to integrate configuration files, which include executing SQL statements to query data, managing system disk files, and sending emails. The integration module includes: A configuration unit is used to configure a log analysis library in the data queried by executing SQL statements, wherein the log analysis library contains a database operation log table; The input module is used to input user needs, formulate user instructions based on the user needs, and issue execution tasks according to the user instructions; The query module is used to query dangerous data from the database based on the execution task, the language model, and the executed SQL statement, and to analyze the database based on the language model. The query module includes: The acquisition unit is used to acquire risky operation records from the database based on the execution task and the language model; The query unit is used to query dangerous data based on the execute_sql tool that executes the SQL statement to query data and the db_operation_log table; The generation module is used to generate an HTML report using the system disk files and the dangerous data, and send the HTML report to a preset address based on the email sending.

4. A readable storage medium having a computer program stored thereon, characterized in that, When executed by the processor, the program implements the database operation log risk warning method as described in any one of claims 1 to 2.

5. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the database operation log risk warning method as described in any one of claims 1 to 2.

Images