Abnormal access behavior detection method and device and electronic equipment

Abstract

The invention discloses an abnormal access behavior detection method and device and electronic equipment. The method relates to the field of artificial intelligence, and comprises the following steps: acquiring a plurality of traffic packets accessing a target database, and analyzing the plurality of traffic packets to obtain traffic packet characteristics of each traffic packet; determining a session record for accessing the target database based on the traffic packet characteristics of each traffic packet, and extracting a structured query statement from the session record; converting the structured query statement into an access behavior vector through a word vector model, and inputting the access behavior vector into a target model to obtain an access behavior classification result, the target model being obtained by training a plurality of groups of training samples, and each group of training samples comprising a historical access behavior vector and a historical access behavior classification result; and determining an abnormal access behavior detection result of the plurality of traffic packets based on the access behavior classification result. Through the method and the device, the problem of inaccurate detection of the abnormal access behavior of the database in related technologies is solved.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence, and more specifically, to a method, apparatus, and electronic device for detecting abnormal access behavior. Background Technology

[0002] With the development of information technologies such as cloud computing, big data, and the Internet of Things, databases are increasingly becoming the center of data storage, computing, and analysis, supporting the operation of enterprise business systems. Database security has become a significant factor affecting enterprise operational security and user privacy. Among related technologies, rule-based anomaly analysis is the primary method for detecting abnormal database access. However, rule-based anomaly analysis methods cannot identify potential threatening behaviors within massive amounts of access data. Furthermore, rule-based anomaly analysis methods have a limited monitoring dimension, making them unsuitable for high-dimensional dynamic behaviors and unable to uncover the inherent patterns and change trajectories within the system.

[0003] There is currently no effective solution to the problem of inaccurate detection of abnormal database access behavior in related technologies. Summary of the Invention

[0004] The main objective of this application is to provide a method, apparatus, and electronic device for detecting abnormal access behavior, so as to solve the problem of inaccurate detection of abnormal access behavior in databases in related technologies.

[0005] To achieve the above objectives, according to one aspect of this application, an abnormal access behavior detection method is provided. The method includes: acquiring multiple traffic packets accessing a target database; parsing the multiple traffic packets to obtain traffic packet features for each traffic packet; determining session records accessing the target database based on the traffic packet features of each traffic packet; extracting structured query statements from the session records; converting the structured query statements into access behavior vectors using a word vector model; inputting the access behavior vectors into a target model to obtain access behavior classification results, wherein the target model is trained from multiple sets of training samples, each set of training samples including historical access behavior vectors and historical access behavior classification results; and determining abnormal access behavior detection results for the multiple traffic packets based on the access behavior classification results.

[0006] Optionally, obtaining multiple traffic packets accessing the target database includes: monitoring each traffic packet passing through the target network interface and determining whether the communication protocol of each traffic packet is a preset protocol; if the communication protocol of the traffic packet is a preset protocol, identifying the traffic packet as a traffic packet to be parsed; if the communication protocol of the traffic packet is not a preset protocol, identifying the traffic packet as a filtered traffic packet; and identifying all traffic packets to be parsed as multiple traffic packets accessing the target database.

[0007] Optionally, determining the session record for accessing the target database based on the traffic packet characteristics of each traffic packet includes: extracting target features from the traffic packet characteristics, wherein the target features include at least one of the following: source IP address, target IP address, source port, and target port; determining the interrelated traffic packets based on the target features to obtain a traffic packet set; and determining the session record for accessing the target database through the traffic packet set.

[0008] Optionally, converting a structured query statement into an access behavior vector using a word vector model includes: preprocessing the structured query statement to obtain a preprocessed structured query statement, wherein the preprocessing includes at least one of the following: standardization, statement splitting, and encoding; inputting the preprocessed structured query statement into a word vector model to obtain a target word vector; and determining the target word vector as the access behavior vector.

[0009] Optionally, determining the abnormal access behavior detection results of multiple traffic packets based on the access behavior classification results includes: extracting the probability of the access behavior vector belonging to each behavior type from the access behavior classification results, wherein the behavior type includes at least one of the following: business system operation, server monitoring, and operation and maintenance personnel operation; determining that multiple traffic packets have abnormal access behavior when the probability of the access behavior vector belonging to each behavior type is less than the probability threshold; and determining that multiple traffic packets do not have abnormal access behavior when the probability of the access behavior vector belonging to the target behavior type is greater than or equal to the probability threshold, wherein the target behavior type is one of the following: business system operation, server monitoring, and operation and maintenance personnel operation.

[0010] Optionally, the target model is trained as follows: Historical access records from the target database are obtained, and a set of traffic packets is extracted from these records; the structured query statements for each traffic packet in the traffic packet set are extracted to obtain a set of structured query statements; the set of structured query statements is converted into a set of access behavior vectors using a word vector model; the set of access behavior vectors is input into a pre-defined clustering model to obtain multiple clusters; the behavior type corresponding to each cluster is determined, and labels are added to the access behavior vectors according to the cluster to which they belong, where the labels represent the behavior type to which the access behavior vectors belong; the labeled set of access behavior vectors is used as a training sample set, and a pre-defined neural network model is trained using the training sample set to obtain the target model.

[0011] Optionally, after determining the abnormal access behavior detection results of multiple traffic packets based on the access behavior classification results, the method further includes: if the abnormal access behavior detection results indicate that multiple traffic packets do not have abnormal access behavior, determining the access behavior vectors corresponding to the multiple traffic packets as new training samples; adding the new training samples to the training sample set to obtain an updated training sample set; and updating the target model based on the updated training sample set to obtain an updated target model.

[0012] To achieve the above objectives, according to another aspect of this application, an abnormal access behavior detection device is provided. The device includes: an acquisition unit, configured to acquire multiple traffic packets accessing a target database, parse the multiple traffic packets, and obtain traffic packet features for each traffic packet; a first determination unit, configured to determine session records accessing the target database based on the traffic packet features of each traffic packet, and extract structured query statements from the session records; a conversion unit, configured to convert the structured query statements into access behavior vectors using a word vector model, and input the access behavior vectors into a target model to obtain access behavior classification results, wherein the target model is trained from multiple sets of training samples, each set of training samples including historical access behavior vectors and historical access behavior classification results; and a second determination unit, configured to determine abnormal access behavior detection results for the multiple traffic packets based on the access behavior classification results.

[0013] In this embodiment, multiple traffic packets accessing the target database are acquired, parsed, and the traffic packet features of each traffic packet are obtained. Based on the traffic packet features of each traffic packet, session records accessing the target database are determined, and structured query statements are extracted from the session records. The structured query statements are converted into access behavior vectors using a word vector model, and these access behavior vectors are input into a target model to obtain access behavior classification results. The target model is trained using multiple sets of training samples, each set including historical access behavior vectors and historical access behavior classification results. The abnormal access behavior detection results of multiple traffic packets are determined based on the access behavior classification results. By parsing the traffic packets, constructing session records for accessing the database, and then extracting access behavior vectors from the session records, the access behavior classification results based on the access behavior vectors determine whether abnormal access behavior exists in the traffic packets. This achieves the goal of multi-dimensional detection of database access behavior, thereby improving the accuracy of abnormal database access behavior detection and solving the technical problem of inaccurate abnormal database access behavior detection. Attached Figure Description

[0014] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0015] Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for implementing an abnormal access behavior detection method is shown.

[0016] Figure 2 This is a flowchart of an abnormal access behavior detection method provided according to an embodiment of this application;

[0017] Figure 3 This is a schematic diagram of an abnormal access behavior detection device provided according to an embodiment of this application;

[0018] Figure 4 This is a structural block diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0019] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0020] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0021] It should be noted that the information collected in this application (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data used for analysis, etc.) are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of this data all comply with relevant laws, regulations, and standards, necessary confidentiality measures have been taken, and they do not violate public order and good morals. Corresponding access points are provided for users to choose to authorize or refuse. For example, interfaces are set up between this system and relevant users or organizations, providing users with corresponding access points to choose to agree to or refuse automated decision-making results; if the user chooses to refuse, the process proceeds to the expert decision-making stage.

[0022] Example 1

[0023] According to an embodiment of this application, a method embodiment for detecting abnormal access behavior is also provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0024] The method embodiment provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1 A hardware block diagram of a computer terminal (or mobile device) for implementing an abnormal access behavior detection method is shown. Figure 1 As shown, the computer terminal 10 (or mobile device) may include one or more processors 102 (shown as 102a, 102b, ..., 102n in the figure) 102 (processor 102 may include, but is not limited to, processing devices such as MCU (Microcontroller Unit) or FPGA (Field-Programmable Gate Array), memory 104 for storing data, and transmission device 106 for communication functions. In addition, it may also include: a display, input / output interfaces (I / O interfaces), a USB (Universal Serial Bus) port (which may be included as one of the ports of a BUS (Business Bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0025] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0026] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the abnormal access behavior detection method in this embodiment. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby realizing the above-mentioned abnormal access behavior detection method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0027] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0028] The display may be, for example, a touchscreen LCD display that allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0029] In the above operating environment, this application provides a method for detecting abnormal access behavior. Figure 2 This is a flowchart of an abnormal access behavior detection method provided according to an embodiment of this application, such as... Figure 2 As shown, the method includes:

[0030] Step S201: Obtain multiple traffic packets that access the target database, parse the multiple traffic packets, and obtain the traffic packet characteristics of each traffic packet.

[0031] In step S201, a tool for capturing network traffic is installed on the target database server to monitor traffic on the target network interface or port. The captured traffic is forwarded to a log collection server, where the captured traffic packets are parsed and their characteristics are extracted. These characteristics may include source IP address, destination IP address, source port, destination port, database user, login time, logout time, and SQL (Structured Query Language, a standard programming language for managing and manipulating relational databases) operations.

[0032] Step S202: Determine the session records for accessing the target database based on the characteristics of each traffic packet, and extract structured query statements from the session records.

[0033] In step S202, the session record can be constructed based on traffic packet characteristics to characterize a complete access process of a database user to the target database. The session record can be constructed by identifying all access operations performed by the user between login and logout times. Alternatively, it can be based on all access operations corresponding to the same source IP address and destination IP address. After determining the session record, SQL statements, i.e., structured query statements, are extracted from it.

[0034] Step S203: The structured query statement is converted into access behavior vectors through a word vector model, and the access behavior vectors are input into the target model to obtain the access behavior classification results. The target model is trained by multiple sets of training samples, and each set of training samples includes historical access behavior vectors and historical access behavior classification results.

[0035] In step S203, the structured query statement is processed using a word vector model. The word vector model converts keywords, table names, and field names in the SQL statement into multi-dimensional access behavior vectors, which represent the semantic and contextual information of each element in the SQL statement.

[0036] The target model can be a classification model, such as a support vector machine, decision tree, random forest, convolutional neural network, long short-term memory network, etc., used to identify the type of database access behavior. The dataset for training the target model can consist of historical access behavior vectors and corresponding historical access behavior classification results. The training process of the target model can employ supervised learning methods, where training samples can be manually labeled (e.g., historical access behavior classification results labeled by security experts) or obtained from other anomaly detection systems (such as rule-based systems).

[0037] The newly extracted access behavior vectors are input into the trained target model, which then classifies the access behavior vectors based on the learned patterns and outputs the access behavior classification results.

[0038] Step S204: Determine the abnormal access behavior detection results of multiple traffic packets based on the access behavior classification results.

[0039] In step S204, the access behavior classification result may include the probability that the access behavior vector belongs to each behavior type. Behavior types may include business system operations, server monitoring, and operations by maintenance personnel. If the probability of the current access behavior vector belonging to any existing behavior type is less than a preset probability threshold, it indicates that the access behavior vector may pose a risk. If at least one probability is greater than or equal to the probability threshold, it indicates that the access behavior vector belongs to an existing behavior type and there is no abnormal access behavior.

[0040] The abnormal access behavior detection method provided in this application obtains multiple traffic packets accessing a target database, parses these packets to obtain the traffic packet features of each packet, determines the session records accessing the target database based on the traffic packet features of each packet, and extracts structured query statements from the session records. The structured query statements are then converted into access behavior vectors using a word vector model, and these vectors are input into a target model to obtain access behavior classification results. The target model is trained using multiple sets of training samples, each set including historical access behavior vectors and historical access behavior classification results. Based on the access behavior classification results, abnormal access behavior detection results for multiple traffic packets are determined. By parsing the traffic packets, constructing session records for accessing the database, and then extracting access behavior vectors from these records, the method determines whether abnormal access behavior exists in the traffic packets based on the access behavior classification results of the access behavior vectors. This achieves the goal of multi-dimensional detection of database access behavior, thereby improving the accuracy of abnormal database access behavior detection and solving the technical problem of inaccurate abnormal database access behavior detection.

[0041] To improve the processing efficiency of traffic packets, traffic packets are filtered according to their communication protocols. Optionally, in the abnormal access behavior detection method provided in this application embodiment, obtaining multiple traffic packets accessing the target database includes: monitoring each traffic packet passing through the target network interface and determining whether the communication protocol of each traffic packet is a preset protocol; if the communication protocol of the traffic packet is a preset protocol, identifying the traffic packet as a traffic packet to be parsed; if the communication protocol of the traffic packet is not a preset protocol, identifying the traffic packet as a filtered traffic packet; and identifying all traffic packets to be parsed as multiple traffic packets accessing the target database.

[0042] In some examples, to efficiently capture traffic packets accessing the target database, filtering conditions can be set based on the characteristics of database access. This can be done by setting preset communication protocols such as MySQL (MySQL Structured Query Language, a client / server communication protocol) or PostgreSQL (PostgreSQL Structured Query Language, a client / server communication protocol). Network monitoring tools are deployed on the target database server to listen for every traffic packet passing through the target network interface. Real-time monitoring ensures that no potential database access activity is missed.

[0043] For each monitored traffic packet, determine whether its communication protocol matches the preset protocol. If the communication protocol of the traffic packet matches the preset protocol, it indicates that the traffic packet may be accessing the target database, and it is identified as a traffic packet to be parsed. If the communication protocol of the traffic packet does not match the preset protocol, then the traffic packet will be identified as a filtered traffic packet, that is, a traffic packet unrelated to accessing the target database. These traffic packets will be ignored or filtered out to reduce the computational burden of subsequent processing.

[0044] This embodiment obtains multiple traffic packets accessing the target database to ensure that the monitored traffic is directly related to the access to the target database, effectively filtering out irrelevant traffic, thereby improving the efficiency of data processing and the accuracy of subsequent analysis.

[0045] After obtaining the traffic packet characteristics, in order to analyze the user's access behavior to the target database, it is necessary to construct session records. Optionally, in the abnormal access behavior detection method provided in this application embodiment, determining the session records for accessing the target database based on the traffic packet characteristics of each traffic packet includes: extracting target features from the traffic packet characteristics, wherein the target features include at least one of the following: source IP address, target IP address, source port, and target port; determining the interrelated traffic packets based on the target features to obtain a traffic packet set; and determining the session records for accessing the target database through the traffic packet set.

[0046] In some examples, since user actions on the target database may span multiple data packets, it is necessary to reassemble related data packets into a single session record. Session records can be constructed based on source and destination IP addresses, port numbers, and session timestamps. For example, target features of user access behavior can be extracted from traffic packet characteristics. Based on these target features, interrelated traffic packets are identified, resulting in a set of traffic packets. These sets of traffic packets correspond to a single user access to the target database. All user operation information for the target database is extracted from the set of traffic packets, and a session record for the user's access to the target database is constructed based on this operation information.

[0047] Furthermore, session records can be categorized into long sessions and short sessions. A long session refers to an interaction between the user and the database lasting for a duration greater than or equal to a preset time threshold. This may involve multiple queries, transactions, or operations with relatively long time intervals between them. A long session might involve a series of database queries or operations across multiple application scenarios. A short session, on the other hand, refers to an interaction between the user and the database lasting for a duration less than the preset time threshold. In a short session, the user executes a single query, transaction, or operation with relatively short time intervals between these operations. A short session might include simple database operations such as word queries, inserts, updates, or deletes.

[0048] This embodiment constructs session records based on traffic packet features, which can effectively identify and reconstruct database sessions from network traffic, thereby enabling more in-depth behavioral analysis and anomaly detection. This improves the accuracy of abnormal behavior detection.

[0049] To analyze access behavior to the target database in traffic, it is necessary to convert the structured query statements in the traffic packets into access behavior vectors. Optionally, in the abnormal access behavior detection method provided in this application embodiment, converting the structured query statements into access behavior vectors through a word vector model includes: preprocessing the structured query statements to obtain preprocessed structured query statements, wherein the preprocessing includes at least one of the following: standardization processing, statement splitting, and encoding; inputting the preprocessed structured query statements into a word vector model to obtain target word vectors; and determining the target word vectors as access behavior vectors.

[0050] In some examples, before applying a word vector model, the SQL operations and the related tables and fields need to be preprocessed, including normalization, tokenization (i.e., statement splitting), and encoding. Normalization ensures the consistency of the SQL statements, such as converting all keywords to lowercase. Tokenization is the process of breaking down the SQL statement into words and phrases. Encoding converts each token into an integer or a unique identifier. By using a word vector model to convert structured query statements, tables, and fields into vector representations, the high-dimensional text data is reduced to a lower-dimensional vector space, facilitating subsequent processing by machine learning models.

[0051] Word vector models can convert each DML (Data Manipulation Language), DCL (Data Control Language), and DDL (Data Definition Language) operation, as well as tables and fields, in a structured query into a fixed-length vector. These vectors mathematically represent the characteristics of the operations and data entities, and their similarity can be calculated in vector space.

[0052] The preprocessed structured query statement (or its encoded form) is input into the word vector model. The word vector model converts each keyword, table name, field name, etc., into its corresponding vector representation. The vector of each word obtained from the word vector model can be further combined or aggregated to form the vector representation of the entire SQL statement or session, i.e., the target word vector.

[0053] This embodiment converts structured query statements into access behavior vectors, which contain key features and semantic information of the SQL statements. These vectors serve as input to subsequent machine learning models for the analysis and classification of database access behavior, thereby improving the accuracy of identifying normal and abnormal behaviors in database access.

[0054] After obtaining the access behavior classification results output by the target model, the abnormal access behavior detection results are determined based on the access behavior classification results. Optionally, in the abnormal access behavior detection method provided in this application embodiment, determining the abnormal access behavior detection results of multiple traffic packets based on the access behavior classification results includes: extracting the probability of the access behavior vector belonging to each behavior type from the access behavior classification results, wherein the behavior type includes at least one of the following: business system operation, server monitoring, and operation and maintenance personnel operation; determining that multiple traffic packets have abnormal access behavior when the probability of the access behavior vector belonging to each behavior type is less than the probability threshold; and determining that multiple traffic packets do not have abnormal access behavior when the probability of the access behavior vector belonging to the target behavior type is greater than or equal to the probability threshold, wherein the target behavior type is one of the following: business system operation, server monitoring, and operation and maintenance personnel operation.

[0055] In some examples, the classification probability of each access behavior vector belonging to different behavior types is extracted from the access behavior classification results output by the target model. These behavior types may include, but are not limited to, business system operations, server monitoring, and operations personnel operations. Each behavior type has a corresponding probability value, representing the likelihood that the access behavior vector belongs to that type. Based on historical data, security policies, and experience, a probability threshold is set to determine whether the access behavior is abnormal.

[0056] For each access behavior vector, check if the probability of it belonging to each predefined behavior type is less than a set probability threshold. If the probability of all behavior types is less than the threshold, it means that the access behavior vector cannot be clearly classified into any known behavior type, and therefore it can be considered a potential anomalous behavior. Conversely, if the probability of the access behavior vector belonging to a certain target behavior type is greater than or equal to the set probability threshold, it means that the access behavior vector is normal behavior.

[0057] The detection results of all traffic packets are aggregated. If any traffic packet is identified as exhibiting abnormal behavior, or if the proportion of abnormal behavior exceeds a preset threshold for abnormal sessions, the entire session or set of traffic packets will be marked as exhibiting abnormal access behavior. For marked abnormal access behavior, a detailed report is generated, including the nature of the abnormal behavior, possible causes, and information on the database tables and fields involved. Based on this information, appropriate security response measures can be triggered, such as issuing warnings, blocking IP addresses, and restricting database access permissions.

[0058] This embodiment determines the abnormal access behavior detection results through access behavior classification results, effectively identifying and detecting abnormal access behaviors in the database, and improving the sensitivity and accuracy of database security threat detection.

[0059] To identify abnormal access behavior, a target model needs to be trained. Optionally, in the abnormal access behavior detection method provided in this application embodiment, the target model is trained in the following way: obtaining historical access records of the target database and extracting a set of traffic packets from the historical access records; extracting the structured query statement of each traffic packet in the set of traffic packets to obtain a set of structured query statements; converting the set of structured query statements into a set of access behavior vectors through a word vector model, inputting the set of access behavior vectors into a preset clustering model to obtain multiple clusters; determining the behavior type corresponding to each cluster and adding labels to the access behavior vectors according to the cluster to which the access behavior vectors belong, wherein the labels are used to characterize the behavior type to which the access behavior vectors belong; using the labeled set of access behavior vectors as a training sample set, and training a preset neural network model through the training sample set to obtain the target model.

[0060] In some examples, a large amount of historical access records of the target database is obtained, covering various normal and abnormal database access behaviors, to ensure that the target model can learn comprehensively. A set of traffic packets is extracted from the historical access records. Each traffic packet is parsed to extract the structured query statements. A word vector model is used to convert the set of structured query statements into a set of access behavior vectors. The set of access behavior vectors is then input into a pre-defined clustering model to cluster the vectors, resulting in multiple clusters. The purpose of clustering is to group similar database access behaviors into one category and discover the inherent structure of behavioral patterns.

[0061] Based on known database connection client types, such as ECC (Enterprise Control Center) operation and maintenance terminals, performance and capacity monitoring servers, pipeline servers, middleware servers, etc., as well as information such as program statements and monitoring statements, known access behaviors are automatically classified, such as business system operations, production server monitoring, and operation and maintenance personnel operations.

[0062] Labels are added to the access behavior vectors based on the behavior type corresponding to the clusters. Each label represents the behavior type to which each vector belongs, and this serves as the label information for supervised learning. The labeled set of access behavior vectors is used as the training sample set to train a pre-defined neural network model. The neural network model (such as a convolutional neural network, a long short-term memory network, or other deep learning models) learns, through supervised learning, how to map access behavior vectors to their respective behavior types.

[0063] During training, the performance of the target model is evaluated using methods such as cross-validation and confusion matrices to check its classification accuracy. Based on the evaluation results, the model's parameters, structure, or training strategy are adjusted to optimize performance. Once the model's performance reaches the expected standard, the model parameters are saved, resulting in the trained target model. This model can predict the behavior type based on the input access behavior vector, and can be used for real-time or batch database access behavior analysis and anomaly detection.

[0064] This embodiment constructs a target model, starts with the traffic accessing the database, mines behavioral characteristics, classifies database operations using known access sources, database operation commands, session access duration, and other characteristics, and infers suspected abnormal access from massive logs, effectively improving the accuracy and timeliness of risk monitoring.

[0065] To ensure the accuracy of target model detection, the target model needs to be updated periodically. Optionally, in the abnormal access behavior detection method provided in this application embodiment, after determining the abnormal access behavior detection results of multiple traffic packets based on the access behavior classification results, the method further includes: when the abnormal access behavior detection results indicate that multiple traffic packets do not have abnormal access behavior, determining the access behavior vectors corresponding to the multiple traffic packets as new training samples; adding the new training samples to the training sample set to obtain an updated training sample set; and updating the target model based on the updated training sample set to obtain an updated target model.

[0066] In some examples, when the abnormal access behavior detection results show that the access behavior vectors of multiple traffic packets are classified as normal behavior (i.e., no abnormal access behavior), these access behavior vectors are used as new training samples. For traffic packets that are detected as having abnormal access behavior but are confirmed to be normal after review, a new behavior type can be added based on them, and these traffic packets can be used as new training samples. The new training samples are added to the existing training sample set. The target model is retrained using the updated training sample set. The model parameters are fine-tuned to ensure that the model can adapt to the new training samples, thereby improving its accuracy and robustness in detecting abnormal behavior.

[0067] For example, after collecting new traffic package data, it is processed into database access behavior data, which is then input into a classification model for predictive analysis. The analysis results are added to the data pool for database access behavior analysis and identification. When the new data in the data pool reaches a threshold, the new data is mixed evenly with the old data (i.e., the original training samples) to adjust the parameters of the convolutional neural network model and improve the accuracy of the target model identification.

[0068] This embodiment continuously improves the model's performance by adding new training samples and updating the model, enabling it to adapt more effectively to the ever-changing system environment and new security threats.

[0069] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0070] Example 2

[0071] This application also provides an abnormal access behavior detection device. It should be noted that the abnormal access behavior detection device of this application can be used to execute the abnormal access behavior detection method provided in this application. The abnormal access behavior detection device provided in this application is described below.

[0072] According to an embodiment of this application, an apparatus for implementing the above-described abnormal access behavior detection method is also provided. Figure 3 This is a schematic diagram of an abnormal access behavior detection device provided according to an embodiment of this application, such as... Figure 3 As shown, the device includes:

[0073] The acquisition unit 301 is used to acquire multiple traffic packets that access the target database, parse the multiple traffic packets, and obtain the traffic packet characteristics of each traffic packet;

[0074] The first determining unit 302 is used to determine the session record for accessing the target database based on the characteristics of each traffic packet, and extract the structured query statement from the session record.

[0075] The conversion unit 303 is used to convert the structured query statement into access behavior vectors through the word vector model, and input the access behavior vectors into the target model to obtain the access behavior classification result. The target model is trained by multiple sets of training samples, and each set of training samples includes historical access behavior vectors and historical access behavior classification results.

[0076] The second determining unit 304 is used to determine the abnormal access behavior detection results of multiple traffic packets based on the access behavior classification results.

[0077] The abnormal access behavior detection device provided in this application embodiment acquires multiple traffic packets accessing the target database through an acquisition unit 301, parses the multiple traffic packets, and obtains the traffic packet features of each traffic packet; a first determination unit 302 determines the session records accessing the target database based on the traffic packet features of each traffic packet, and extracts structured query statements from the session records; a conversion unit 303 converts the structured query statements into access behavior vectors through a word vector model, and inputs the access behavior vectors into a target model to obtain access behavior classification results, wherein the target model is trained by multiple sets of training samples, each set of training samples including historical access behavior vectors and historical access behavior classification results; a second determination unit 304 determines the abnormal access behavior detection results of multiple traffic packets based on the access behavior classification results, constructs session records accessing the database by parsing the traffic packets, extracts access behavior vectors from the session records, and determines whether there is abnormal access behavior in the traffic packets based on the access behavior classification results of the access behavior vectors, thereby achieving the purpose of multi-dimensional detection of access behavior to the database, thus achieving the technical effect of improving the accuracy of abnormal access behavior detection of the database, and thus solving the technical problem of inaccurate detection of abnormal access behavior to the database.

[0078] Optionally, in the abnormal access behavior detection device provided in this application embodiment, the acquisition unit 301 includes: a monitoring module, used to monitor each traffic packet passing through the target network interface and determine whether the communication protocol of each traffic packet is a preset protocol; a first determination module, used to determine the traffic packet as a traffic packet to be parsed when the communication protocol of the traffic packet is a preset protocol; a second determination module, used to determine the traffic packet as a filtered traffic packet when the communication protocol of the traffic packet is not a preset protocol; and a third determination module, used to determine all traffic packets to be parsed as multiple traffic packets accessing the target database.

[0079] Optionally, in the abnormal access behavior detection device provided in the embodiments of this application, the first determining unit 302 includes: a first extraction module, used to extract target features from traffic packet features, wherein the target features include at least one of the following: source IP address, target IP address, source port and target port; a fourth determining module, used to determine interrelated traffic packets based on the target features to obtain a traffic packet set; and a fifth determining module, used to determine the session records of accessing the target database through the traffic packet set.

[0080] Optionally, in the abnormal access behavior detection device provided in this application embodiment, the conversion unit 303 includes: a preprocessing module, used to preprocess the structured query statement to obtain a preprocessed structured query statement, wherein the preprocessing includes at least one of the following: standardization processing, statement splitting and encoding; an input module, used to input the preprocessed structured query statement into a word vector model to obtain a target word vector; and a sixth determination module, used to determine the target word vector as an access behavior vector.

[0081] Optionally, in the abnormal access behavior detection device provided in this application embodiment, the second determining unit 304 includes: a second extraction module, used to extract the probability of an access behavior vector belonging to each behavior type from the access behavior classification result, wherein the behavior type includes at least one of the following: business system operation, server monitoring, and operation and maintenance personnel operation; a seventh determining module, used to determine that multiple traffic packets have abnormal access behavior when the probability of the access behavior vector belonging to each behavior type is less than a probability threshold; and an eighth determining module, used to determine that multiple traffic packets do not have abnormal access behavior when the probability of the access behavior vector belonging to the target behavior type is greater than or equal to a probability threshold, wherein the target behavior type is one of the following: business system operation, server monitoring, and operation and maintenance personnel operation.

[0082] Optionally, in the abnormal access behavior detection device provided in this application embodiment, the device further includes: a first extraction unit, used to acquire historical access records of a target database and extract a set of traffic packets from the historical access records; a second extraction unit, used to extract the structured query statement of each traffic packet in the set of traffic packets to obtain a set of structured query statements; an input unit, used to convert the set of structured query statements into a set of access behavior vectors through a word vector model, and input the set of access behavior vectors into a preset clustering model to obtain multiple clusters; a first adding unit, used to determine the behavior type corresponding to each cluster and add labels to the access behavior vectors according to the cluster to which the access behavior vectors belong, wherein the labels are used to characterize the behavior type to which the access behavior vectors belong; and a training unit, used to use the labeled set of access behavior vectors as a training sample set and train a preset neural network model through the training sample set to obtain a target model.

[0083] Optionally, in the abnormal access behavior detection device provided in the embodiments of this application, the device further includes: a third determining unit, used to determine the access behavior vectors corresponding to multiple traffic packets as new training samples when the abnormal access behavior detection results indicate that multiple traffic packets do not have abnormal access behavior; a second adding unit, used to add the new training samples to the training sample set to obtain an updated training sample set; and an updating unit, used to update the target model based on the updated training sample set to obtain an updated target model.

[0084] It should be noted that the aforementioned acquisition unit 301, first determination unit 302, conversion unit 303, and second determination unit 304 correspond to steps S201 to S204 in Embodiment 1. The four units and their corresponding steps implement the same instances and application scenarios, but are not limited to the content disclosed in Embodiment 1. It should also be noted that the aforementioned modules or units can be hardware or software components stored in a memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). These modules or units can also run as part of a device in the computer terminal 10 provided in Embodiment 1.

[0085] Example 3

[0086] Embodiments of this application may provide an electronic device. Figure 4 This is a structural block diagram of an electronic device according to an embodiment of this application. Figure 4 As shown, the electronic device may include: one or more ( Figure 4 (Only one is shown) Processor 402, memory 404, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0087] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the methods and apparatus in the embodiments of this application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby implementing the above-described methods. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0088] The processor can access information and applications stored in memory via a transmission device to perform the following steps: acquire multiple traffic packets accessing the target database, parse the multiple traffic packets to obtain the traffic packet features of each traffic packet; determine the session records accessing the target database based on the traffic packet features of each traffic packet, and extract structured query statements from the session records; convert the structured query statements into access behavior vectors using a word vector model, and input the access behavior vectors into the target model to obtain access behavior classification results, wherein the target model is trained from multiple sets of training samples, each set of training samples including historical access behavior vectors and historical access behavior classification results; and determine the abnormal access behavior detection results of multiple traffic packets based on the access behavior classification results.

[0089] The processor can also access information and applications stored in memory via the transmission device to perform the following steps: listen to each traffic packet passing through the target network interface and determine whether the communication protocol of each traffic packet is a preset protocol; if the communication protocol of the traffic packet is a preset protocol, identify the traffic packet as a traffic packet to be parsed; if the communication protocol of the traffic packet is not a preset protocol, identify the traffic packet as a filtered traffic packet; identify all traffic packets to be parsed as multiple traffic packets accessing the target database.

[0090] The processor can also invoke information and applications stored in the memory via the transmission device to perform the following steps: extracting target features from traffic packet features, wherein the target features include at least one of the following: source IP address, destination IP address, source port, and destination port; determining interrelated traffic packets based on the target features to obtain a traffic packet set; and determining session records that access the target database through the traffic packet set.

[0091] The processor can also invoke information and applications stored in the memory via a transmission device to perform the following steps: preprocessing the structured query statement to obtain a preprocessed structured query statement, wherein the preprocessing includes at least one of the following: standardization, statement splitting and encoding; inputting the preprocessed structured query statement into a word vector model to obtain target word vectors; and determining the target word vectors as access behavior vectors.

[0092] The processor can also invoke information and applications stored in the memory via the transmission device to perform the following steps: extracting the probability of an access behavior vector belonging to each behavior type from the access behavior classification results, wherein the behavior type includes at least one of the following: business system operation, server monitoring, and operation and maintenance personnel operation; determining that multiple traffic packets have abnormal access behavior when the probability of the access behavior vector belonging to each behavior type is less than the probability threshold; determining that multiple traffic packets do not have abnormal access behavior when the probability of the access behavior vector belonging to the target behavior type is greater than or equal to the probability threshold, wherein the target behavior type is one of the following: business system operation, server monitoring, and operation and maintenance personnel operation.

[0093] The processor can also access information and applications stored in the memory via a transmission device to perform the following steps: obtain historical access records from the target database and extract a set of traffic packets from the historical access records; extract the structured query statement for each traffic packet in the set of traffic packets to obtain a set of structured query statements; convert the set of structured query statements into a set of access behavior vectors using a word vector model, input the set of access behavior vectors into a preset clustering model to obtain multiple clusters; determine the behavior type corresponding to each cluster and add labels to the access behavior vectors according to the cluster to which they belong, where the labels are used to characterize the behavior type to which the access behavior vectors belong; use the labeled set of access behavior vectors as a training sample set and train a preset neural network model using the training sample set to obtain the target model.

[0094] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: when the abnormal access behavior detection results indicate that multiple traffic packets do not have abnormal access behavior, the access behavior vectors corresponding to the multiple traffic packets are determined as new training samples; the new training samples are added to the training sample set to obtain the updated training sample set; the target model is updated based on the updated training sample set to obtain the updated target model.

[0095] This application provides a scheme for obtaining multiple traffic packets accessing a target database, parsing these traffic packets to obtain the traffic packet features of each packet, determining session records for accessing the target database based on the traffic packet features of each packet, extracting structured query statements from the session records, converting the structured query statements into access behavior vectors using a word vector model, and inputting the access behavior vectors into a target model to obtain access behavior classification results. The target model is trained using multiple sets of training samples, each set including historical access behavior vectors and historical access behavior classification results. Based on the access behavior classification results, the scheme determines the abnormal access behavior detection results of multiple traffic packets. By parsing traffic packets, constructing session records for accessing the database, extracting access behavior vectors from these records, and determining whether traffic packets exhibit abnormal access behavior based on the access behavior classification results, this approach achieves the goal of multi-dimensional detection of database access behavior, thereby improving the accuracy of abnormal database access behavior detection and solving the technical problem of inaccurate abnormal database access behavior detection.

[0096] Those skilled in the art will understand that Figure 4 The structure shown is for illustrative purposes only. Electronic devices can also be smartphones, tablets, handheld computers, mobile internet devices (MIDs), PADs, and other terminal devices. Figure 4This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 4 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 4 The different configurations shown.

[0097] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0098] Example 4

[0099] Embodiments of this application also provide a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the abnormal access behavior detection method provided in Embodiment 1.

[0100] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0101] This application also provides a computer program product that, when executed on a data processing device, is suitable for performing steps of an abnormal access behavior detection method.

[0102] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0103] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0104] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0105] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0106] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0107] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0108] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for detecting abnormal access behavior, characterized in that, include: Obtain multiple traffic packets that access the target database, parse the multiple traffic packets, and obtain the traffic packet characteristics of each traffic packet; Based on the traffic packet characteristics of each traffic packet, determine the session records for accessing the target database, and extract structured query statements from the session records; The structured query statement is converted into access behavior vectors using a word vector model, and the access behavior vectors are input into the target model to obtain access behavior classification results. The target model is trained from multiple sets of training samples, and each set of training samples includes historical access behavior vectors and historical access behavior classification results. The abnormal access behavior detection results of the multiple traffic packets are determined based on the access behavior classification results.

2. The method according to claim 1, characterized in that, The multiple traffic packets obtained from accessing the target database include: Monitor each traffic packet passing through the target network interface and determine whether the communication protocol of each traffic packet is the preset protocol; If the communication protocol of the traffic packet is the preset protocol, the traffic packet is identified as the traffic packet to be parsed; If the communication protocol of the traffic packet is not the preset protocol, the traffic packet will be identified as a filtered traffic packet. All traffic packets to be parsed are identified as multiple traffic packets accessing the target database.

3. The method according to claim 1, characterized in that, The session records for accessing the target database are determined based on the traffic packet characteristics of each traffic packet, including: Target features are extracted from the traffic packet features, wherein the target features include at least one of the following: source IP address, destination IP address, source port, and destination port; Based on the target characteristics, interrelated traffic packets are identified to obtain a traffic packet set; The session records that access the target database are determined by the set of traffic packets.

4. The method according to claim 1, characterized in that, Converting the structured query statement into access behavior vectors using a word vector model includes: The structured query statement is preprocessed to obtain a preprocessed structured query statement, wherein the preprocessing includes at least one of the following: standardization, statement splitting, and encoding; The preprocessed structured query statement is input into the word vector model to obtain the target word vector; The target word vector is determined as the access behavior vector.

5. The method according to claim 1, characterized in that, The abnormal access behavior detection results of the multiple traffic packets determined based on the access behavior classification results include: Extract the probability that the access behavior vector belongs to each behavior type from the access behavior classification results, wherein the behavior type includes at least one of the following: business system operation, server monitoring, and operation and maintenance personnel operation; If the probability of the access behavior vector belonging to each behavior type is less than the probability threshold, it is determined that the multiple traffic packets have abnormal access behavior. If the probability that the access behavior vector belongs to the target behavior type is greater than or equal to the probability threshold, it is determined that there is no abnormal access behavior in the multiple traffic packets, wherein the target behavior type is one of the following: the business system operation, the server monitoring, and the operation and maintenance personnel operation.

6. The method according to claim 1, characterized in that, The target model is trained in the following manner: Obtain historical access records of the target database, and extract a set of traffic packets from the historical access records; Extract the structured query statement for each traffic packet in the traffic packet set to obtain a set of structured query statements; The set of structured query statements is converted into a set of access behavior vectors using a word vector model. The set of access behavior vectors is then input into a preset clustering model to obtain multiple clusters. Determine the behavior type corresponding to each cluster, and add a label to the access behavior vector according to the cluster to which the access behavior vector belongs, wherein the label is used to characterize the behavior type to which the access behavior vector belongs; The set of access behavior vectors after being signed is used as the training sample set, and a preset neural network model is trained using the training sample set to obtain the target model.

7. The method according to claim 1, characterized in that, After determining the abnormal access behavior detection results of the multiple traffic packets based on the access behavior classification results, the method further includes: If the abnormal access behavior detection results indicate that there is no abnormal access behavior in the multiple traffic packets, the access behavior vectors corresponding to the multiple traffic packets are determined as new training samples. The newly added training samples are added to the training sample set to obtain the updated training sample set. The target model is updated based on the updated training sample set to obtain the updated target model.

8. An abnormal access behavior detection device, characterized in that, include: The acquisition unit is used to acquire multiple traffic packets that access the target database, parse the multiple traffic packets, and obtain the traffic packet characteristics of each traffic packet; The first determining unit is used to determine the session record for accessing the target database based on the traffic packet characteristics of each traffic packet, and extract the structured query statement from the session record; The conversion unit is used to convert the structured query statement into access behavior vectors through a word vector model, and input the access behavior vectors into a target model to obtain access behavior classification results. The target model is trained by multiple sets of training samples, and each set of training samples includes historical access behavior vectors and historical access behavior classification results. The second determining unit is used to determine the abnormal access behavior detection results of the multiple traffic packets based on the access behavior classification results.

9. An electronic device, characterized in that, include: Memory, which stores executable programs; A processor for running the program, wherein the program executes the abnormal access behavior detection method according to any one of claims 1 to 7 when it runs.

10. A computer program product comprising computer instructions, characterized in that, When the computer instructions are executed by the processor, they implement the steps of the abnormal access behavior detection method according to any one of claims 1 to 7.

Images