Multi-factor database access behavior risk analysis method and system

Abstract

According to the multi-factor database access behavior risk analysis method and system provided by the invention, before the SQL is executed, the potential data risk and performance risk of the SQL are subjected to accurate, quantitative and multi-dimensional comprehensive pre-judgment, so that the intelligence and accuracy of active defense of the database are fundamentally improved; and the problems of data security and system stability caused by malicious or accidental operation are effectively prevented. According to the method, static structure risk analysis of the SQL statement and deep analysis of an execution plan generated by a database optimizer are combined; a data asset sensitivity factor is introduced, and the business importance of each data table involved in SQL operation is included in a final risk score; through two core dynamic factors, accurate quantification of the risk is realized.

Description

Technical Field

[0001] This invention belongs to the field of database firewall technology, specifically relating to a multi-factor database access behavior risk analysis method and system. Background Technology

[0002] Database management systems (DBMS) are core infrastructure of modern information technology, responsible for storing, managing, and retrieving critical business data. With the increasing value of data, ensuring database security and preventing data leakage, tampering, or loss due to malicious attacks or accidental misoperations has become a top priority in information security. Database firewalls, as a proactive defense technology for DBMSs, are deployed between applications and database servers. Their purpose is to monitor and filter all incoming SQL (Structured Query Language) requests in real time, identifying and blocking high-risk or illegal SQL operations before they are executed by the database.

[0003] Current mainstream database firewall technologies primarily rely on static analysis of SQL statements for risk assessment. They identify high-risk keywords and structural risks through rule matching and attack signature matching. This approach is simple to implement, has low performance overhead, and only involves processing the SQL text itself, without deep interaction with the database kernel. However, static analysis also has limitations, such as a single assessment dimension, inability to understand the actual execution path of the database, and decoupling from the value of data assets. This mechanism makes it unable to effectively distinguish between an efficient operation precisely located through an index and an inefficient, high-risk operation that will trigger a full table scan. It also cannot adjust the risk rating based on the importance of the data target, resulting in distorted risk assessment results and frequent false positives and false negatives.

[0004] Therefore, there is an urgent need for a new database firewall technology to perform risk analysis on database access behavior. Summary of the Invention

[0005] Purpose of the invention: To address the problems existing in current database firewall technology, this invention proposes a multi-factor database access behavior risk analysis method and system. While ensuring the low-latency interception capability of the database firewall, it deeply integrates the static structural risks of SQL, the sensitivity of data assets, and the risks of dynamically generated execution plans in the database.

[0006] Technical solution:

[0007] This invention proposes a multi-factor database access behavior risk analysis method, including:

[0008] Intercept the SQL to be executed in the target database, parse the structure of the SQL, and extract typical features, including operation type, data target set, and structural features;

[0009] By combining the preset weights with the typical characteristics, the static risk coefficient factor of the SQL is calculated;

[0010] The asset sensitivity factor of this SQL statement is obtained from the data asset sensitivity mapping table;

[0011] Send a query statement to the target database, obtain the execution plan tree corresponding to the SQL, count the predicted number of data rows affected by the SQL in the execution plan tree, and calculate the fluctuation factor of the SQL.

[0012] Traverse all operation nodes of the execution plan tree, accumulate the risk score of each node, and obtain the complexity risk factor of the SQL.

[0013] The final risk score of the SQL is calculated by multiplying the static risk coefficient factor, asset sensitivity factor, volatility factor, and complexity risk factor, and then classified according to preset rules.

[0014] Furthermore, the static risk coefficient factor, asset sensitivity factor, volatility factor, and complexity risk factor are all normalized within the same normalization interval. The larger the value obtained after normalization for each factor, the higher the risk.

[0015] Furthermore, the calculation of the static risk coefficient factor of the SQL includes:

[0016] Static risk factor The calculation formula is:

[0017]

[0018] in Preset weights are assigned to each operation type, with higher weights indicating higher risks. For the operation types UPDATE, DELETE, and TRUNCATE, the corresponding preset weight values ​​increase sequentially, and the weight value of TRUNCATE is the maximum value of the normalized interval.

[0019] The structural risk multiplier is used to penalize high-risk structural features, and its calculation formula is as follows:

[0020]

[0021] The score is the score of the element in the structural feature. The higher the score, the higher the risk. x is the total number of elements in the structural feature.

[0022] Furthermore, the scores of the elements in the structural features include , , If the structural features contain a WHERE clause, The value is the minimum value of the normalized interval, otherwise it is the maximum value of the normalized interval; if the structural feature contains a join filter condition, The value is a specific midpoint of the normalized interval; otherwise, it is the minimum value of the normalized interval. If an INSERT statement exists, structured risks are ignored. The value is the minimum value of the normalized interval.

[0023] Furthermore, the data asset sensitivity mapping table is evaluated by business experts based on the degree of data sensitivity, and a corresponding risk value is set for each type of data table in the target database. The range of the risk value is the same as the normalization range.

[0024] Furthermore, the calculation of the volatility factor of the SQL includes:

[0025] From the structured execution plan tree Extract the predicted number of data rows affected by the SQL statement. ,according to Calculate the fluctuation of the SQL in the current analysis ,when Less than or equal to the system-set query limit At that time, volatility factor The formula is as follows:

[0026]

[0027] like Greater than ,but for .

[0028] Furthermore, the complexity risk factor for obtaining the SQL includes:

[0029] Traversing the execution plan tree All operation nodes Accumulate the risk score for each node. Calculate the complexity risk factor of this SQL statement. The formula is as follows:

[0030]

[0031] In the above formula For the node index in the plan tree.

[0032] Furthermore, the risk score corresponding to the operation node includes:

[0033] Nested loop join operation: scoring method is ,in For the depth of nesting, This is the minimum value within the normalized range;

[0034] Sorting operation: Scoring method is ,in The number of data rows affected by the operation, returned by the execution plan.

[0035] Furthermore, the hierarchical processing according to preset rules includes:

[0036] The calculated final risk score With the preset threshold , Compare;

[0037] when At that time, Transparent clearance;

[0038] when At that time, Perform the operation of releasing the data and recording detailed audit logs, including the original SQL and the scoring details of each factor in the aforementioned steps;

[0039] when At that time, block The system executes the alerts and sends risk warnings to management personnel.

[0040] This invention also proposes a multi-factor database access behavior risk analysis system, comprising:

[0041] The parsing module is used to intercept the SQL to be executed in the target database, parse the structure of the SQL, and extract typical features, including operation type, data target set and structural features;

[0042] The calculation module is used to combine preset weights with the typical features to calculate the static risk coefficient factor of the SQL; obtain the asset sensitivity factor of the SQL according to the data asset sensitivity mapping table; send a query statement to the target database to obtain the execution plan tree corresponding to the SQL, count the predicted number of data rows affected by the SQL in the execution plan tree, and calculate the volatility factor of the SQL; traverse all operation nodes of the execution plan tree, accumulate the risk score of each node, and obtain the complexity risk factor of the SQL.

[0043] The evaluation module multiplies the static risk coefficient factor, asset sensitivity factor, volatility factor, and complexity risk factor to calculate the final risk score of the SQL, and then performs grading according to preset rules.

[0044] Beneficial effects:

[0045] This invention proposes a multi-factor database access behavior risk analysis method and system. Before SQL execution, it performs accurate, quantitative, and multi-dimensional comprehensive prediction of potential data and performance risks, fundamentally improving the intelligence and accuracy of proactive database defense, and effectively preventing data security and system stability problems caused by malicious or accidental operations. Specifically, it includes the following beneficial effects:

[0046] 1. A Combined Static and Dynamic Assessment Method: This invention creatively combines static structural risk analysis of SQL statements (static) with in-depth analysis of execution plans generated by the database optimizer (dynamic). This allows risk assessment to extend beyond the SQL text and delve into the actual execution level of the database, thus achieving a more comprehensive and accurate characterization of risks.

[0047] 2. Deep Integration of Risk Assessment and Data Asset Value: This invention introduces a data asset sensitivity factor, incorporating the business importance of each data table involved in the SQL operation into the final risk score. This ensures that operations on core and sensitive data receive higher risk weights, making the assessment results highly consistent with actual business risks.

[0048] 3. Dual Quantification of Impact Scope and Execution Complexity: This invention achieves precise risk quantification through two core dynamic factors. First, it uses baseline estimates in the execution plan to quantify the impact scope of the operation; second, it uses an execution plan complexity risk factor, which quantifies the potential performance risk of the operation through weighted scoring of high-cost operation nodes. This dual quantification fundamentally solves the distortion and blind spots of static analysis. Attached Figure Description

[0049] Figure 1 This is a flowchart of the method of the present invention;

[0050] Figure 2 This is a structural diagram of the system of the present invention. Detailed Implementation

[0051] The present invention will be further explained below with reference to the accompanying drawings and specific embodiments. Figure 1 The diagram shows a flowchart of a multi-factor database access behavior risk analysis method proposed in this invention, which specifically includes the following steps:

[0052] S1: Intercept the raw SQL operation to be executed in the target database through a proxy. Let this SQL be... .

[0053] S2: Yes Syntax parsing is performed to extract features. The features extracted in this embodiment include:

[0054] (1) Operation types, including UPDATE (update data), DELETE (delete data), TRUNCATE (truncate / clear table), etc.;

[0055] (2) Data target set ,in This indicates the i-th specific target table of the current SQL statement, and n represents the total number of tables in the current SQL result set.

[0056] (3) Set of structural features ,gather Each element represents a typical structural feature, including WHERE, JOIN, SUBQUERY, etc.

[0057] The operation types and structural features extracted above can be expanded according to the database type and actual business needs.

[0058] S3: Calculate the static risk factor of this SQL statement. This is used to describe the inherent risks of SQL statements themselves, and the formula is as follows:

[0059]

[0060] in The basic risk weight is assigned an artificial score based on the destructive potential of the SQL operation type to the data, and the score is normalized to a defined range. In this embodiment, the normalized range is [1, 5]. The basic risk weights corresponding to each operation type analyzed in S2 are as follows:

[0061] (1) TRUNCATE: This indicates that clearing the table is a high-risk operation.

[0062] (2) DELETE: This indicates that deleting data carries a high risk.

[0063] (3) UPDATE: This means that updating data carries a certain risk.

[0064] The structural risk multiplier is used to penalize high-risk SQL structures, and the formula is as follows:

[0065]

[0066] The elements in the structural features obtained from S2 include , , Let x be the total number of elements in the structural feature. Determine each [structure / feature] according to the rules. Features in SQL statements If a feature appears in the given information, a specified score is assigned to it. The normalized interval of this score is the same as the normalized interval of the basic risk weight score ([1,5]). If a feature does not appear, its score is set to the minimum value of the normalized interval, which is 1.0 in this embodiment. The specific scoring in this embodiment is as follows:

[0067] (1) In a DELETE, SELECT, or UPDATE statement, if no WHERE filter condition appears, let This indicates that this is a very high-risk full table operation; otherwise, let ;

[0068] (2) Does the DELETE, SELECT, or UPDATE statement contain a JOIN clause? If it does, let... Otherwise, ;

[0069] (3) For INSERT statements, ignore the structured risks and directly set... .

[0070] S4: Calculate the asset sensitivity score for this SQL statement. The formula is as follows:

[0071]

[0072] in , Table of corresponding data asset sensitivity mapping Score If a data table is not included in the data asset sensitivity mapping table, assign it a score. It is the minimum value.

[0073] The data asset sensitivity mapping table is a structured table or set of rules that explicitly maps specific data assets to their corresponding sensitivity levels. Business experts manually assess the sensitivity of internal data and assign a corresponding risk value to each type of data table within the target database. The risk value falls within the same range as the normalized range, and the sensitivity of data tables varies across different scenarios. A partial data asset sensitivity mapping table from this embodiment is shown in Table 1.

[0074] Table 1. Data Asset Sensitivity Mapping Table (Partial)

[0075] Data table content Sensitivity score Combined Data Table 1 Name, Phone Number 3 Combined Data Table 2 Name, phone number, address 5 Single Data Table 1 Name 2 Single data table 2 Employee ID 2

[0076] S5: According to Based on the type of the target database, generate a query statement to obtain the structured execution plan of the target database. For example, in MySQL, the corresponding query would be: EXPLAIN FORMAT=JSON Send and execute to the database server. Obtain the execution plan tree in a structured format (such as JSON). including operator nodes Data source nodes and the relationships between nodes.

[0077] S6: From the structured execution plan tree Extract the predicted value that will ultimately affect the number of data rows. The predicted value represents the scope of the SQL's impact. For PostgreSQL, when the execution plan returns a JSON object, it has:

[0078]

[0079] For PostgreSQL databases, the predicted number of rows is in the execution plan. Under the field Field value retrieval. The expression above references the syntax for retrieving values ​​from JSON data in Python programming.

[0080] according to Calculate the fluctuation of the SQL in the current analysis ,when Less than or equal to the system-set query limit At that time, the fluctuation was divided into The formula is as follows:

[0081]

[0082] in This indicates the system's set query limit, such as... The maximum number of impact items allowed by the corresponding system is . The maximum value representing the range of normalization. The value of takes a range of [1, N+1]. If ,but for .

[0083] S7: Traverse the execution plan tree All operation nodes Accumulate the risk score for each node. Calculate the complexity risk factor of this SQL statement. The formula is as follows:

[0084]

[0085] In the above formula Each Normalized to a specific range, each operational node and its corresponding risk score include:

[0086] (1) Nested Loop Join: The scoring method is as follows ,in For the depth of nesting, This is the minimum value within the normalized range;

[0087] (2) Sort operation: The scoring method is as follows ,in The execution plan returns the specific number of rows affected by the operation. SQL can be broken down into multiple sub-operations. This represents the scope of influence of all sub-operations, because sorting large amounts of data consumes a lot of memory and CPU, so The more operations you perform, the slower and more resource-intensive it becomes, and the higher your risk score will be.

[0088] S8: Based on the aforementioned S3 Factors, S4 obtained Factors, S6 obtained Factors and S7 obtained Factor multiplication is used to calculate the final risk score for SQL. The formula is as follows:

[0089]

[0090] S9: Calculate the final risk score With the preset threshold , The comparison is performed, and the corresponding hierarchical processing strategy is executed. Among these, < .

[0091] In this embodiment, the threshold is set by: running the system in bypass mode for a period of time and recording each database access. Value (a range); based on security requirements, from Defined in the interval value and This process is similar to firewall deployment; security rules and thresholds need to be adjusted multiple times based on the company's specific needs.

[0092] The hierarchical processing strategy specifically includes:

[0093] when At that time, Transparent clearance;

[0094] when At that time, Perform the operation of releasing the data and recording detailed audit logs, including the original SQL and the scoring details of each factor in the aforementioned steps;

[0095] when At that time, block The system executes the alerts and sends risk warnings to management personnel.

[0096] This invention also proposes an analysis system based on the above analysis method, the external connections of which are as follows: Figure 2 As shown, the business system publishes SQL to the database. The business layer where the system resides intercepts the SQL to be executed, performs risk analysis on the SQL with reference to the data asset sensitivity mapping table, adapts different processing strategies based on the assessment results, and passes it to the database.

Claims

1. A multi-factor database access behavior risk analysis method, characterized in that, include: Intercept the SQL to be executed in the target database, parse the structure of the SQL, and extract typical features, including operation type, data target set, and structural features; By combining the preset weights with the typical characteristics, the static risk coefficient factor of the SQL is calculated; The asset sensitivity factor of this SQL statement is obtained from the data asset sensitivity mapping table; Send a query statement to the target database, obtain the execution plan tree corresponding to the SQL, count the predicted number of data rows affected by the SQL in the execution plan tree, and calculate the fluctuation factor of the SQL. Traverse all operation nodes of the execution plan tree, accumulate the risk score of each node, and obtain the complexity risk factor of the SQL. The final risk score of the SQL is calculated by multiplying the static risk coefficient factor, asset sensitivity factor, volatility factor, and complexity risk factor, and then classified according to preset rules.

2. The database access behavior risk analysis method according to claim 1, characterized in that, The static risk coefficient factor, asset sensitivity factor, volatility factor, and complexity risk factor are all normalized within the same normalization interval. The larger the value obtained after normalization for each factor, the higher the risk.

3. The database access behavior risk analysis method according to claim 2, characterized in that, The calculation of the static risk coefficient factor for this SQL includes: Static risk factor The calculation formula is: in Preset weights are assigned to each operation type, with higher weights indicating higher risks. For the operation types UPDATE, DELETE, and TRUNCATE, the corresponding preset weight values ​​increase sequentially, and the weight value of TRUNCATE is the maximum value of the normalized interval. The structural risk multiplier is used to penalize high-risk structural features, and its calculation formula is as follows: The score is the score of the element in the structural feature. The higher the score, the higher the risk. x is the total number of elements in the structural feature.

4. The database access behavior risk analysis method according to claim 3, characterized in that, The scores of the elements in the structural features include , , If the structural features contain a WHERE clause, The value is the minimum value of the normalized interval, otherwise it is the maximum value of the normalized interval; if the structural feature contains a join filter condition, The value is a specific midpoint of the normalized interval; otherwise, it is the minimum value of the normalized interval. If an INSERT statement exists, ignore the structured risks. The value is the minimum value of the normalized interval.

5. The database access behavior risk analysis method according to claim 4, characterized in that, The data asset sensitivity mapping table is evaluated by business experts based on the degree of data sensitivity, and a corresponding risk value is set for each type of data table in the target database. The range of the risk value is the same as the normalization range.

6. The database access behavior risk analysis method according to claim 5, characterized in that, The calculation of the volatility factor of the SQL includes: From the structured execution plan tree Extract the predicted number of data rows affected by the SQL statement. ,according to Calculate the fluctuation of the SQL in the current analysis ,when Less than or equal to the system-set query limit At that time, volatility factor The formula is as follows: like Greater than ,but for .

7. The database access behavior risk analysis method according to claim 6, characterized in that, The complexity risk factors for obtaining this SQL include: Traversing the execution plan tree All operation nodes Accumulate the risk score for each node. Calculate the complexity risk factor of this SQL statement. The formula is as follows: In the above formula For the node index in the plan tree.

8. The database access behavior risk analysis method according to claim 7, characterized in that, The risk score corresponding to the operation node includes: Nested loop join operation: scoring method is ,in For the depth of nesting, This is the minimum value within the normalized range; Sorting operation: Scoring method is ,in The number of data rows affected by the operation, returned by the execution plan.

9. The database access behavior risk analysis method according to claim 8, characterized in that, The hierarchical processing according to preset rules includes: The calculated final risk score With the preset threshold , Compare; when At that time, Transparent clearance; when At that time, Perform the operation of releasing the data and recording detailed audit logs, including the original SQL and the scoring details of each factor in the aforementioned steps; when At that time, block The system executes the alerts and sends risk warnings to management personnel.

10. A multi-factor database access behavior risk analysis system, characterized in that, include: The parsing module is used to intercept the SQL to be executed in the target database, parse the structure of the SQL, and extract typical features, including operation type, data target set and structural features; The calculation module is used to combine preset weights with the typical features to calculate the static risk coefficient factor of the SQL; and to obtain the asset sensitivity factor of the SQL according to the data asset sensitivity mapping table. Send a query statement to the target database, obtain the execution plan tree corresponding to the SQL, count the predicted number of data rows affected by the SQL in the execution plan tree, and calculate the volatility factor of the SQL; traverse all operation nodes of the execution plan tree, accumulate the risk score of each node, and obtain the complexity risk factor of the SQL. The evaluation module multiplies the static risk coefficient factor, asset sensitivity factor, volatility factor, and complexity risk factor to calculate the final risk score of the SQL, and then performs grading according to preset rules.

Images