Audit method, device, equipment, medium and product
By acquiring and analyzing key operation event information in real time and generating full-link audit logs, the problem of difficult traceability of key operations in traditional database auditing solutions is solved, and precise monitoring and security improvement of key operations are achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- JINZHUAN INFORMATION TECHNOLOGY CO LTD
- Filing Date
- 2025-12-31
- Publication Date
- 2026-04-10
AI Technical Summary
Traditional database auditing solutions lack fine-grained tracking of key operations, making it difficult to trace the source of key leaks or malicious operations, and making it impossible to quickly and accurately locate the operator, time, method, and key.
Real-time acquisition of key operation event information, capture of context information, generation of audit log records, and full-link auditing through risk scoring and machine learning models to generate security audit logs.
It enables end-to-end auditing of key operation events, accurately answers key questions in security incident investigations, and improves the monitoring efficiency and security of key operations.
Smart Images
Figure CN121833445A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of database security, and in particular to an auditing method, device, equipment, medium and product. BACKGROUND
[0002] With the increasing value of data assets, the security of the database as the storage carrier of core data is crucial. Encryption is a standard practice for protecting sensitive data in databases, and the security of the security key (including master key, table key, column key, etc.) used for encryption directly determines the effectiveness of the entire encryption system.
[0003] Traditional database auditing solutions focus on recording data itself, such as adding, deleting, modifying, and searching (DML operation), but lack fine-grained and inevitable auditing tracking for underlying key management operations (such as key creation, rotation, etc.). This makes key operations a security black box, and it is difficult to trace the root cause once a key leak or malicious operation occurs.
[0004] Even if some database systems record key operation events, these records are often isolated and fail to effectively associate key operations with specific data access requests, database sessions that perform the operation, user identity, and application program source that initiates the request. This leads to difficulties in quickly and accurately locating "who, when, how, which key, and what operation" during security incident investigations. SUMMARY
[0005] The present application provides an auditing method, device, equipment, medium and product to realize full-link auditing of key operation events.
[0006] According to an aspect of the present application, an auditing method is provided, comprising:
[0007] real-time acquisition of event information of a key operation event on a database security key;
[0008] According to the event information, context information related to the key operation event is captured to obtain an audit log record of the key operation event;
[0009] According to the event information, a risk score of the key operation event is determined;
[0010] The audit log record and risk score are associated and stored in a security audit log.
[0011] According to another aspect of the present application, an auditing device is provided, comprising:
[0012] An information acquisition module is configured to acquire event information of a key operation event on a database security key in real time;
[0013] a flow acquisition module configured to acquire context information related to the key operation event according to the event information, to obtain an audit flow record of the key operation event;
[0014] a risk analysis module configured to determine a risk score of the key operation event according to the event information;
[0015] a flow storage module configured to store the audit flow record and the risk score in a security audit log in association.
[0016] According to another aspect of the present application, there is provided a computer program product comprising a computer program which, when executed by a processor, implements the audit method according to any of the embodiments of the present application.
[0017] According to another aspect of the present application, there is provided an electronic device comprising at least one processor, and a memory connected to the at least one processor in communication; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to perform the audit method according to any of the embodiments of the present application.
[0018] According to another aspect of the present application, there is provided a computer readable storage medium storing computer instructions for causing a processor to perform the audit method according to any of the embodiments of the present application when executed by the processor.
[0019] The embodiments of the present application can accurately answer the key questions such as "who, when, where, what, how" in the security event investigation by monitoring the key operation event and generating the full-link security audit log, and realize the full-link audit of the key operation event.
[0020] It should be understood that the content described in this part is not intended to identify key or important features of the embodiments of the present application, nor to limit the scope of the present application. Other features of the present application will become apparent from the following description. BRIEF DESCRIPTION OF DRAWINGS
[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can also be obtained by those skilled in the art without creative labor on the basis of these drawings.
[0022] Figure 1is a flow chart of an auditing method according to an embodiment of the present application;
[0023] Figure 2 is a flow chart of an auditing method according to another embodiment of the present application;
[0024] Figure 3 is a structural schematic diagram of an auditing device according to another embodiment of the present application;
[0025] Figure 4 is a structural schematic diagram of an electronic device implementing an embodiment of the present application. DETAILED DESCRIPTION
[0026] In order to make the personnel in the technical field better understand the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor should fall within the scope of protection of the present application.
[0027] It should be noted that the terms "first", "second", and the like in the present application are used to distinguish similar objects, and do not necessarily indicate a specific order or a chronological sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device that includes a series of steps or units does not have to be limited to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.
[0028] Figure 1 is a flow chart of an auditing method according to an embodiment of the present application, which can be applied to the case where the database security key needs to be managed artificially. The method can be executed by an auditing device, which can be implemented in the form of hardware and / or software, and can be configured in an electronic device with corresponding data processing capability. As shown in the figure, the method comprises: Figure 1
[0029] S110, acquiring event information of a key operation event of a database security key in real time.
[0030] S120, according to the event information, capturing context information related to the key operation event to obtain an audit log record of the key operation event.
[0031] S130, determining a risk operation event of the key operation event according to the event information.
[0032] S140, storing the audit log and the risk score in association into a security audit log.
[0033] The event type of the key operation event includes: key generation, key rotation, key enable / disable, key authorization, key destruction, encryption / decryption operation, batch operation. The context information includes at least one of the following: login username, client application name, operation type and associated SQL statement.
[0034] Specifically, the key operation event of the database security key is monitored, and when the key operation event occurs, the event information of the key operation event is extracted in real time.
[0035] After obtaining the event information, on the one hand, the event information is further analyzed to obtain the context information related to the key operation event, and the audit log required for auditing the key operation event is generated with reference to the context information.
[0036] On the other hand, a predefined operation rule library is defined, such as "unauthorized IP address attempts key operation", "key rotation during non-peak business hours", "abnormal access frequency", "batch export operation", "data encryption / decryption", "account risk-remote login-multiple IP login", "abnormal access traffic", and other security policies. According to the security policy corresponding to the event type of the key operation event, the risk score of the key operation event is calculated. Meanwhile, machine learning model training and optimization are introduced, and through the existing rule library, risk score and coping strategy, based on historical data feature points, black and white list training rules, threshold rules, etc. Train abnormal samples for quickly identifying operation events whose event types are not defined, and determine the risk score.
[0037] After determining the risk score and the audit log of the key operation event, the audit log is standardized in format, and the audit log and the risk score are associated and written into the security audit log by using encryption signature, so as to ensure the integrity and non-tamperability of the security audit log.
[0038] The embodiments of the present application can accurately answer the key questions such as "who, when, where, what, how" in the security event investigation by monitoring the key operation event and generating a full-link security audit log, and realize full-link auditing of the key operation event.
[0039] On the basis of the above-mentioned embodiments, the method further comprises:
[0040] In response to a user's query operation on a target audit element, the target audit log record and target risk score related to the target audit element are retrieved from the security audit log.
[0041] A query report is generated based on the target audit log and target risk score.
[0042] Specifically, the system provides an audit log query and retrieval interface, supporting users to perform traceability analysis and evidence collection based on audit elements such as time range, key ID, user, operation type, and risk score. Users input the target audit element they want to query, such as a key ID. The system then searches the security audit logs based on this target audit element to identify target audit logs containing or related to that element and target risk scores. The system then organizes the retrieved target audit logs and risk scores into a preset report template, generating a target query report, which is then pushed or displayed to the user. For example, if a key is leaked, the user can quickly see from the target query report that someone has operated on that key.
[0043] Optionally, based on the above embodiments, after determining the risk score of the key operation event according to the event information, the method further includes:
[0044] If the risk score does not meet the execution conditions, then the key operation corresponding to the current key operation event is blocked.
[0045] If the risk score meets the execution conditions, the execution result of the key operation corresponding to the current key operation event is recorded.
[0046] Specifically, execution conditions are set for each key operation. For example, the risk score must not exceed a threshold. If the risk score of a key operation event does not meet the execution conditions, the system needs to not only record the corresponding audit log in the background, but also actively block the key operation corresponding to the current key operation event and issue an alarm. At this time, the alarm information also needs to be associated with the other two and stored in the security audit log. If the risk score of a key operation event meets the execution conditions, the system only needs to record the corresponding audit log in the background and does not need to block the key operation corresponding to the previous key operation event.
[0047] Figure 2 This is a flowchart illustrating an auditing method according to another embodiment of the present invention. This embodiment is an optimization and improvement upon the above embodiments. Figure 2 As shown, the method includes:
[0048] S210, syntax analysis is performed on the interface call statement related to the database security key by using a database probe and a database parser to obtain a to-be-responded operation event; if the to-be-responded operation event is a key operation event, event information of the key operation event is extracted.
[0049] Specifically, the database probe technology is used to capture all interface calls related to the security key and the specific call statement in real time based on the database parser result. Syntax analysis is performed on the call statement to obtain the to-be-responded operation event. The event type of the to-be-responded operation event is analyzed according to the syntax analysis result, that is, whether the operation object of the to-be-responded operation event is the database security key is determined. If the to-be-responded operation event is a key operation event, the event information thereof is extracted for further processing. If the to-be-responded operation event is not a key operation event, the to-be-responded operation event is normally processed, and no additional operation is performed.
[0050] S220, context information related to the event information is queried from the operation record of the database according to the login IP and the operation time in the event information.
[0051] S230, the context information and the event information are integrated into an audit log record of the key operation event.
[0052] Specifically, the login IP and the operation time are extracted from the event information, and the operation record of each operation event is stored in the database. According to the login IP and the operation time, the related operation of the current key operation is determined, and then the context information of the current key operation is queried from the operation record of the related operation. After the context information is obtained, the context information and the event information are integrated to obtain the audit log record which includes the context information and the event information.
[0053] S240, the risk score of the key operation event is determined according to the event information.
[0054] S250, the audit log record and the risk score are stored in the security audit log in association.
[0055] The embodiment of the application improves the listening efficiency of the key operation event by analyzing the interface call statement to listen to the key operation event.
[0056] Figure 3 A structural schematic diagram of an audit device provided by another embodiment of the application is shown in FIG. 3. Figure 3 As shown in the figure, the device comprises:
[0057] An information acquisition module 310 is configured to acquire event information of a key operation event of a database security key in real time.
[0058] The audit flow record of the key operation event is obtained by the audit device according to the event information.
[0059] The risk analysis module 330 is configured to determine a risk score of the key operation event according to the event information.
[0060] The flow record storage module 340 is configured to store the audit flow record and the risk score in a security audit log.
[0061] The audit device provided by the embodiments of the present application can execute the audit method provided by any of the embodiments of the present application, and has the corresponding function modules and beneficial effects of the execution method.
[0062] Optionally, the flow record acquisition module 320 comprises:
[0063] The query unit is configured to query the context information related to the event information in the operation record of the database according to the login IP and the operation time in the event information.
[0064] The integration unit is configured to integrate the context information and the event information into the audit flow record of the key operation event.
[0065] Optionally, the context information comprises at least one of the following: a login username, a client application name, an operation type and an associated SQL statement.
[0066] Optionally, the device further comprises a log query module configured to, in response to a query operation of a user on a target audit element, acquire a target audit flow record and a target risk score related to the target audit element from the security audit log; and generate a query report according to the target audit flow record and the target risk score.
[0067] Optionally, the device further comprises:
[0068] The event blocking module is configured to, if the risk score does not meet an execution condition, block a key operation corresponding to the current key operation event.
[0069] The event release module is configured to, if the risk score meets the execution condition, record an execution result of the key operation corresponding to the current key operation event.
[0070] Optionally, the information acquisition module 310 comprises:
[0071] The information query unit is configured to query the context information related to the event information in the operation record of the database according to the login IP and the operation time in the event information.
[0072] An information obtaining unit is configured to integrate the context information and the event information into an audit log of the key operation event.
[0073] The audit device further illustrated can also execute the audit method provided by any embodiment of the present application, and has the function modules and beneficial effects corresponding to the execution method.
[0074] Figure 4 A structural schematic diagram of an electronic device 40 that can be used to implement embodiments of the present application is shown. The electronic device is intended to represent various forms of digital computers, such as laptops, desktops, tablets, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular telephones, smart phones, wearable devices (e.g., headsets, glasses, watches, etc.), and other similar computing devices. The components shown here, their connections and relationships, and their functions, are meant to be examples only, and are not meant to limit implementations of the present application described and / or claimed in this document.
[0075] As shown in Figure 4 The electronic device 40 includes at least one processor 41, and a memory, such as a read-only memory (ROM) 42, a random access memory (RAM) 43, etc., connected to the at least one processor 41 in communication, where the memory stores computer programs executable by the at least one processor. The processor 41 can perform various appropriate actions and processes according to the computer programs stored in the read-only memory (ROM) 42 or loaded from the storage unit 48 into the random access memory (RAM) 43. In the RAM 43, various programs and data required for the operation of the electronic device 40 can also be stored. The processor 41, the ROM 42, and the RAM 43 are connected to each other through a bus 44. An input / output (I / O) interface 45 is also connected to the bus 44.
[0076] Various components in the electronic device 40 are connected to the I / O interface 45, including an input unit 46, such as a keyboard, a mouse, etc.; an output unit 47, such as various types of displays, speakers, etc.; a storage unit 48, such as a magnetic disk, an optical disk, etc.; and a communication unit 49, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 49 allows the electronic device 40 to exchange information / data with other devices through a computer network, such as the Internet, and / or various telecommunications networks.
[0077] The processor 41 can be various general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the processor 41 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, and the like. The processor 41 performs various methods and processes described above, such as the audit method.
[0078] In some embodiments, the audit method can be implemented as a computer program tangibly embodied in a computer readable storage medium, such as the storage unit 48. In some embodiments, part or all of the computer program can be loaded and / or installed onto the electronic device 40 via the ROM 42 and / or the communication unit 49. When the computer program is loaded onto the RAM 43 and executed by the processor 41, one or more steps of the audit method described above can be performed. Alternatively, in other embodiments, the processor 41 can be configured to perform the audit method by any other suitable means, such as by means of firmware.
[0079] Various implementations of the systems and techniques described above can be realized in digital electronic circuitry, integrated circuitry, a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on a chip (SOC), a programmable logic device (CPLD), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include implementation in one or more computer programs that are executable and / or interpretable on a programmable system including at least one programmable processor, which can be special or general purpose, coupled to receive data and instructions from, and to transmit data and instructions to, a storage system, at least one input device, and at least one output device.
[0080] Computer programs used to implement the methods of the application can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the computer program, when executed by the processor, implements the functions / acts specified in the flowcharts and / or block diagrams. The computer program can be executed entirely on a machine, partially on a machine, partially on a machine as a standalone software package, and partially on a machine or entirely on a remote machine or server.
[0081] In the context of the present application, a computer-readable storage medium can be a tangible medium that can contain or store a computer program for use by or in connection with an instruction execution system, apparatus, or device. A computer-readable storage medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium can be a machine-readable signal medium. More specific examples of a machine-readable storage medium will include one or more lines of a program of instructions in a transitory signal, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.
[0082] To provide for interaction with a user, the systems and techniques described here can be implemented on an electronic device having a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the electronic device. Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form, including acoustic, speech, or tactile input.
[0083] The systems and techniques described here can be implemented in a computing system that includes a back end component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front end component (e.g., a user computer having a graphical user interface or a Web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such back end, middleware, or front end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.
[0084] The computing system can include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system, to solve the defects of large management difficulty and weak business scalability in traditional physical host and VPS service.
[0085] It should be understood that the various forms of flow shown above can be used to reorder, add or delete steps. For example, each step described in the present application can be executed in parallel, sequentially or in a different order, as long as the desired results of the technical solutions of the present application can be achieved, which is not limited herein.
[0086] The above detailed description does not constitute a limitation on the scope of protection of the present application. Those skilled in the art should understand that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent replacements and improvements made within the spirit and principles of the present application shall be included in the scope of protection of the present application.
Claims
1. An auditing method, characterized in that, The method includes: Real-time acquisition of event information related to key operations on the database security key; Based on the event information, extract the context information related to the key operation event to obtain the audit log record of the key operation event; Determine the risk score of the key operation event based on the event information; The audit log entries and risk scores are associated and stored in the security audit log.
2. The method according to claim 1, characterized in that, The step of retrieving context information related to the key operation event based on the event information to obtain the audit log record of the key operation event includes: Based on the login IP and operation time in the event information, query the context information related to the event information in the operation records of the database; The context information and event information are integrated into an audit log of the key operation event.
3. The method according to claim 1 or 2, characterized in that, The context information includes at least one of the following: login username, client application name, operation type, and associated SQL statement.
4. The method according to claim 2, characterized in that, The event information for the real-time acquisition of key operation events related to the database security key includes: The database probe and database parser are used to perform syntax parsing on the interface call statements related to the database security key to obtain the operation events to be responded to. If the operation event to be responded to is a key operation event, then the event information of the key operation event is extracted.
5. The method according to claim 1, characterized in that, The method further includes: In response to a user's query operation on a target audit element, the target audit log record and target risk score related to the target audit element are retrieved from the security audit log. A query report is generated based on the target audit log and target risk score.
6. The method according to claim 1, characterized in that, After determining the risk score of the key operation event based on the event information, the method further includes: If the risk score does not meet the execution conditions, then the key operation corresponding to the current key operation event is blocked. If the risk score meets the execution conditions, the execution result of the key operation corresponding to the current key operation event is recorded.
7. An auditing device, characterized in that, The device includes: The information acquisition module is used to acquire event information of key operation events on the database security key in real time; The log entry module is used to capture context information related to the key operation event based on the event information, and obtain the audit log record of the key operation event; The risk analysis module is used to determine the risk score of the key operation event based on the event information; The log storage module is used to associate and store the audit log records and risk scores in the security audit log.
8. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the auditing method according to any one of claims 1-6.
9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that, when executed by a processor, implement the auditing method of any one of claims 1-6.
10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the auditing method according to any one of claims 1-6.