Auditing method for database auditing rule optimization

Abstract

The invention provides a database-based auditing rule optimization method, which comprises the following steps of: installing an agent program or configuring bypass monitoring equipment so as to comprehensively capture flow and operation logs of a database; cleaning and filtering the collected data, and removing invalid or repeated information; making auditing rules, adjusting threshold values and conditions of the rules according to business requirements and compliance requirements, and processing auditing results; database operation is analyzed in real time, and when an auditing rule is triggered, an alarm notice is sent out immediately; audit data is stored in a safe and reliable database for subsequent query and analysis; the auditing data is deeply mined and analyzed by applying a data analysis tool and algorithm, and through the method, potential safety risks and abnormal operations are found in time, an alarm is accurately given, and key information really needing to be concerned is accurately captured.

Description

Technical Field

[0001] This invention relates to the field of database auditing technology, and in particular to an auditing method for optimizing database auditing rules. Background Technology

[0002] In today's information age, database systems are widely used in various fields. Whether it's core business processing in enterprises, administrative management in government agencies, or data analysis in research institutions, all rely on the support of database systems. Because databases store a large amount of critical and sensitive information, their security is paramount. To ensure database security, database auditing systems have emerged. These systems can comprehensively audit various activities within the database, promptly identifying potential security risks and abnormal operations.

[0003] However, in practical applications, database auditing systems suffer from a prominent problem—excessive alerts. On the one hand, too many alerts make it easy to overlook or miss truly important ones that may indicate serious security threats or system failures. On the other hand, administrators need to spend a significant amount of time and effort filtering and analyzing such a large number of alerts, which greatly reduces work efficiency and increases management costs. Furthermore, existing database auditing rules have certain limitations in their design. They may be too broad, causing some insignificant events to trigger alerts; or they may not be precise enough to accurately capture the truly critical information that needs attention. This not only wastes resources but also reduces administrators' trust in the alerting system. Therefore, optimizing the auditing rules of any database auditing system has become an imperative task. Summary of the Invention

[0004] This invention provides an auditing method based on database auditing rule optimization, which is used to promptly detect potential security risks and abnormal operations and accurately issue alerts, thereby capturing the key information that truly needs attention.

[0005] Firstly, an auditing method based on database auditing rules optimization is provided, including:

[0006] Install an agent or configure a bypass monitoring device to fully capture database traffic and operation logs;

[0007] The collected data is cleaned and filtered to remove invalid or duplicate information.

[0008] Develop audit rules and adjust the thresholds and conditions of the rules according to business needs and compliance requirements, and process the audit results;

[0009] Real-time analysis of database operations; when audit rules are triggered, an alarm notification is issued immediately.

[0010] Audit data is stored in a secure and reliable database for subsequent querying and analysis;

[0011] We utilize data analysis tools and algorithms to conduct in-depth mining and analysis of audit data.

[0012] In one implementation, the operation log includes user login, query, modification, and deletion operations.

[0013] In one implementation, the agent program or configured bypass monitoring device supports multiple database protocols, including MySQL, Oracle, SQL Server, and DM.

[0014] In one implementation, after cleaning and filtering the collected data to remove invalid or duplicate information, the process further includes parsing database operation statements and extracting key information, including capture time, user, operation type, and operation object.

[0015] In one implementation, the audit rules include access rules, operation rules, injection attack rules, and password attack rules.

[0016] In one implementation, the alarm notification is an audit log, which specifically includes the following information: SQL statement, capture time, rule type, rule name, risk level, database user, database name, client IP, operating system user, execution result, protected database, and the statement rule to which it belongs.

[0017] In one implementation, after using data analysis tools and algorithms to deeply mine and analyze the audit data, the method further includes generating regular audit reports, including operational statistics, abnormal behavior analysis, and compliance assessments.

[0018] In one implementation, audit result processing includes:

[0019] For duplicate alarms generated by the same client IP within a specified time period, deduplication is performed. During deduplication, factors such as the type of operation, the object, and the time interval are taken into account to ensure that truly duplicate alarms are accurately removed.

[0020] The deduplicated audit results are categorized according to different rule types;

[0021] Integrate the deduplicated alarm information, generate detailed database audit result reports, and deliver them to the relevant business system database administrators for result confirmation.

[0022] In one implementation, the rule types for audit results include access rules, operation rules, injection attacks, and password attacks.

[0023] In one implementation, alarm information includes two situations: first, the database behavior of the alarm is a necessary requirement of the business system, i.e., a false alarm; second, the database behavior of the alarm is a valid alarm.

[0024] This invention provides a database audit rule optimization method, comprising: installing an agent program or configuring a bypass monitoring device to comprehensively capture database traffic and operation logs; cleaning and filtering the collected data to remove invalid or duplicate information; formulating audit rules and adjusting the thresholds and conditions of the rules according to business needs and compliance requirements, and processing the audit results; analyzing database operations in real time and issuing an alarm notification immediately when an audit rule is triggered; storing the audit data in a secure and reliable database for subsequent querying and analysis; and using data analysis tools and algorithms to perform in-depth mining and analysis of the audit data. Through the above methods, potential security risks and abnormal operations can be discovered in a timely manner and alarms can be accurately issued, accurately capturing the key information that truly needs attention.

[0025] Other features and advantages of the invention will be set forth in the following description, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and accompanying drawings. Attached Figure Description

[0026] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this invention, illustrate exemplary embodiments of the invention and are used to explain the invention, but do not constitute an undue limitation of the invention. In the drawings:

[0027] Figure 1 This invention relates to an auditing method that optimizes database auditing rules according to an embodiment of the present invention. Detailed Implementation

[0028] To promptly identify potential security risks and abnormal operations and issue accurate alerts, and to accurately capture the key information that truly needs attention, an auditing method based on optimized database auditing rules is provided.

[0029] The preferred embodiments of the present invention will be described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit the present invention.

[0030] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of the embodiments of the present invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in a sequence other than that illustrated or described herein.

[0031] like Figure 1 As shown, the embodiment provides an auditing method based on database auditing rules optimization, including:

[0032] S11. Install an agent or configure a bypass monitoring device to fully capture database traffic and operation logs;

[0033] Data Acquisition. Install an agent or configure a bypass monitoring device to comprehensively capture database traffic and operation logs, including user logins, queries, modifications, and deletions. It also supports multiple database protocols, such as MySQL, Oracle, SQL Server, and DM.

[0034] S12. Clean and filter the collected data to remove invalid or duplicate information;

[0035] Data preprocessing. The collected data is cleaned and filtered to remove invalid or duplicate information. Then, database operation statements are parsed to extract key information, including capture time, user, operation type, and operation object.

[0036] S13. Develop audit rules and adjust the thresholds and conditions of the rules according to business needs and compliance requirements, and process the audit results;

[0037] Rule configuration. Develop audit rules, including access rules, operation rules, injection attack rules, and password attack rules. Adjust rule thresholds and conditions flexibly based on business needs and compliance requirements.

[0038] The process for processing database audit results is as follows:

[0039] Step 1: IP-based alarm deduplication. For duplicate alarms generated by the same client IP within a specified time period, deduplication is performed. During deduplication, factors such as the type of operation, the target, and the time interval are comprehensively considered to ensure accurate removal of truly duplicate alarms.

[0040] Step 2: Categorize Audit Results. Categorize the deduplicated audit results according to different rule types, including access rules, operation rules, injection attacks, and password attacks.

[0041] Step 3: Generate a database audit results report. Integrate the deduplicated alarm information and generate a detailed database audit results report. This report is then delivered to the relevant business system database administrator for result confirmation. Specifically, this includes two scenarios: first, the alarmed database behavior is a necessary requirement of the business system, i.e., a false alarm; second, the alarmed database behavior is a valid alarm.

[0042] S14. Analyze database operations in real time and issue an alarm notification immediately when an audit rule is triggered;

[0043] Real-time monitoring and alerts. Database operations are analyzed in real time, and an alert is immediately issued when an audit rule is triggered. The alert is issued as an audit log, which includes the following information: SQL statement, capture time, rule type, rule name, risk level, database user, database name, client IP, operating system user, execution result, protected database, and the associated statement rule.

[0044] S15. Store audit data in a secure and reliable database for subsequent querying and analysis;

[0045] Data storage and backup. Store audit data in a secure and reliable database for subsequent querying and analysis. Back up audit data regularly to ensure its availability and integrity.

[0046] S16. Use data analysis tools and algorithms to conduct in-depth mining and analysis of audit data.

[0047] Data Analysis and Reporting. Utilize data analysis tools and algorithms to conduct in-depth mining and analysis of audit data. Generate regular audit reports, including operational statistics, anomaly analysis, and compliance assessments.

[0048] To make it easier to understand, a specific example is given below:

[0049] 1. The general database auditing method flow of this invention is as follows:

[0050] Step 1: Data Acquisition. Install an agent or configure a bypass monitoring device to comprehensively capture database traffic and operation logs, including user login, query, modification, and deletion operations. It should also support multiple database protocols, such as MySQL, Oracle, SQL Server, and DM.

[0051] Step Two: Data Preprocessing. The collected data is cleaned and filtered to remove invalid or duplicate information. Then, database operation statements are parsed to extract key information, including capture time, user, operation type, and operation object.

[0052] Step 3: Rule Configuration. Develop audit rules, including access rules, operation rules, injection attack rules, and password attack rules. Adjust rule thresholds and conditions flexibly based on business needs and compliance requirements.

[0053] Step 4: Real-time Monitoring and Alerts. Database operations are analyzed in real time, and an alert is immediately issued when an audit rule is triggered. The alert is sent as an audit log, which includes the following information: SQL statement, capture time, rule type, rule name, risk level, database user, database name, client IP, operating system user, execution result, protected database, and the associated statement rule.

[0054] Step 5: Data Storage and Backup. Store audit data in a secure and reliable database for subsequent querying and analysis. Back up audit data regularly to ensure its availability and integrity.

[0055] Step Six: Data Analysis and Reporting. Utilize data analysis tools and algorithms to conduct in-depth mining and analysis of the audit data. Generate regular audit reports, including operational statistics, anomaly analysis, and compliance assessments.

[0056] The following technical effects can be achieved:

[0057] 1) Understand database operation status: Being able to obtain detailed information on various operations in the database helps to fully understand the database usage.

[0058] 2) Timely risk detection: Real-time monitoring and alerts can detect risks as soon as they occur, reducing potential losses.

[0059] 2. The process flow of the database audit result processing method of the present invention is as follows:

[0060] Step 1: IP-based alarm deduplication. For duplicate alarms generated by the same client IP within a specified time period, deduplication is performed. During deduplication, factors such as the type of operation, the target, and the time interval are comprehensively considered to ensure accurate removal of truly duplicate alarms.

[0061] Step 2: Categorize Audit Results. Categorize the deduplicated audit results according to different rule types, including access rules, operation rules, injection attacks, and password attacks.

[0062] Step 3: Generate a database audit results report. Integrate the deduplicated alarm information and generate a detailed database audit results report. This report is then delivered to the relevant business system database administrator for result confirmation. Specifically, this includes two scenarios: first, the alarmed database behavior is a necessary requirement of the business system, i.e., a false alarm; second, the alarmed database behavior is a valid alarm.

[0063] This embodiment provides an auditing method based on optimized database auditing rules. Through a proposed database audit result processing mechanism, it analyzes database audit results within a specified time period, removes duplicate alarms, and generates reports for administrator confirmation, effectively improving the accuracy and usability of audit results. Simultaneously, the proposed audit rule optimization method for false alarms includes excluding business system IPs, setting trust statements, and creating new trust rules, aiming to reduce false alarms, improve the efficiency and reliability of database auditing, and thus better ensure the security and stable operation of the database.

[0064] The main innovative points of this invention include:

[0065] A general database auditing method. It can comprehensively and systematically audit database operations.

[0066] Database audit result processing methods. By analyzing the audit results, removing duplicate alerts, and generating reports, administrators can gain a clearer and more accurate understanding of the database status.

[0067] We propose methods to optimize database audit rules, including excluding specific IPs, setting trust statements, and creating new trust rules, which significantly reduce false alarms and improve audit efficiency and reliability.

[0068] The technical problems that this invention can solve include:

[0069] 1. Resolving false alarms in database auditing. Database auditing can generate alerts that are incorrectly identified as risky behavior, known as false alarms. By processing database audit results and optimizing audit rules, these false alarms can be reduced or even eliminated, allowing administrators to focus on addressing genuine risks.

[0070] 2. Audit rules can be optimized to meet the actual needs of the business system. Existing audit rules may be too strict or not meet the specific operational requirements of the business system, leading to false alarms for some normal business operations. This application can adjust and optimize audit rules according to the actual situation of the business system, making the rules more aligned with business needs and avoiding unnecessary alarms.

[0071] 3. Establish an effective audit rule optimization mechanism. Previously, the lack of scientific and systematic audit rule optimization methods made it difficult to accurately identify the characteristics and patterns of false alarms and to make effective rule adjustments accordingly. This application proposes specific processes and methods, including excluding business system IPs, setting trust statements, and creating new trust rules, which can establish an effective audit rule optimization mechanism, improve the accuracy and adaptability of audit rules, and thus enhance the security and stability of the database.

[0072] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the invention.

[0073] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. An auditing method for optimizing database auditing rules, characterized in that, include: Install an agent or configure a bypass monitoring device to fully capture database traffic and operation logs; The collected data is cleaned and filtered to remove invalid or duplicate information. Develop audit rules and adjust the thresholds and conditions of the rules according to business needs and compliance requirements, and process the audit results; Real-time analysis of database operations; when audit rules are triggered, an alarm notification is issued immediately. Audit data is stored in a secure and reliable database for subsequent querying and analysis; We utilize data analysis tools and algorithms to conduct in-depth mining and analysis of audit data.

2. The method according to claim 1, characterized in that, The operation log includes user login, query, modification, and deletion operations.

3. The method according to claim 2, characterized in that, The agent program or configured bypass monitoring device supports multiple database protocols, including: MySQL, Oracle, SQL Server, and DM.

4. The method according to claim 3, characterized in that, After cleaning and filtering the collected data to remove invalid or duplicate information, the process also includes parsing database operation statements and extracting key information, including capture time, user, operation type, and operation object.

5. The method according to claim 4, characterized in that, The audit rules include access rules, operation rules, injection attack rules, and password attack rules.

6. The method according to claim 5, characterized in that, The alarm notification method is an audit log, which specifically includes the following information: SQL statement, capture time, rule type, rule name, risk level, database user, database name, client IP, operating system user, execution result, protected database and the statement rule to which it belongs.

7. The method according to claim 6, characterized in that, After using data analysis tools and algorithms to conduct in-depth mining and analysis of audit data, the process also includes generating regular audit reports, including operational statistics, abnormal behavior analysis, and compliance assessments.

8. The method according to claim 7, characterized in that, Audit result processing includes: For duplicate alarms generated by the same client IP within a specified time period, deduplication is performed. During deduplication, factors such as the type of operation, the object, and the time interval are taken into account to ensure that truly duplicate alarms are accurately removed. The deduplicated audit results are categorized according to different rule types; Integrate the deduplicated alarm information, generate detailed database audit result reports, and deliver them to the relevant business system database administrators for result confirmation.

9. The method according to claim 8, characterized in that, The rule types for audit results include access rules, operation rules, injection attacks, and password attacks.

10. The method according to claim 9, characterized in that, Alarm information includes two situations: one is that the database behavior of the alarm is a necessary requirement of the business system, i.e., a false alarm; the other is that the database behavior of the alarm is a valid alarm.

Images