A data update security detection method and system

Abstract

The application provides a data update security detection method and system, comprising: obtaining current connection multiplexing frequency and high-frequency short connection turnover data from a database connection pool, collecting execution logs of session reset granularity and authority cleaning period, and determining cleaning completion degree according to whether the authority cleaning task is completed when the connection is released; extracting user identifiers and authority tokens from the request declaration identity and the actual execution identity corresponding to the high-risk group, evaluating the possibility of cross-user inheritance, and generating an authority residual probability score; feeding back to the database connection pool according to the adjusted authority cleaning execution period, comparing the number of abnormal session detections and the total number of sessions before and after the adjustment, evaluating the detection coverage of the blind area, and obtaining an unauthorized update behavior detection report.

Description

Technical Field

[0001] This invention relates to the field of information technology, and in particular to a data update security detection method and system. Background Technology

[0002] In high-concurrency, multi-permission scenarios such as university academic affairs management systems, on the one hand, to improve efficiency, connection pools reuse established database connections, avoiding the huge overhead of frequent creation and destruction, to support massive requests during peak periods such as course selection and grade inquiries. This is a common technical solution to ensure system responsiveness. On the other hand, to ensure security, it is essential to ensure that the session context (such as permission tokens and temporary authorizations) of a connection is thoroughly cleaned before it is assigned to different users, in order to achieve strict permission isolation between users. Ideally, after each connection is returned, it should be cleaned and verified before being securely reassigned. However, this contradiction is difficult to reconcile in practice. If thorough cleanup is performed, the multi-step database interaction verification will significantly increase latency and drag down performance; if connections are reused frequently for performance, the execution time window of the cleanup task will inevitably be compressed or even squeezed. The permission cleanup task involves multiple database interactions such as token cancellation and state reset, which itself takes time. When system resources are preempted by a large number of user requests, the scheduling priority of the background cleanup task is reduced, and its execution is easily delayed or interrupted. The rapid return of a large number of connections will also cause cleanup requests to accumulate in the queue, forming a waiting queue. As a result, a connection carrying the advanced privilege token of a previous user (such as an academic administrator) is assigned to a subsequent user (such as a regular student) before the cleanup task has started or been completed. In this case, because the system's identity verification mechanism may rely on the session information carried by the connection, the residual privilege token of the previous user may cause the system to misjudge subsequent operations as legitimate high-privilege requests. In the context of university grade management, this means that a regular student may inadvertently inherit the administrator's privileges, thereby being able to modify grades, access other students' student records, and other sensitive data without authorization, leading to serious privacy leaks and data tampering risks. For example, in the prior art CN202411873440.8, "A Public Use Case Library Management Method Based on Dynamic Access Control," the background section clearly points out that in database connection reuse scenarios, if excessive pursuit of reuse efficiency is neglected in the context of thorough cleanup, it will lead to residual privileges and unauthorized access; conversely, if thorough cleanup is emphasized each time, it will damage system performance. This patent's background technology clearly acknowledges and describes this common problem of residual privileges at the database connection layer. Summary of the Invention

[0003] This invention provides a data update security detection method, mainly including: Obtain current connection reuse frequency and high-frequency short connection turnover data from the database connection pool, collect execution logs of session reset granularity and permission cleanup cycle, and determine the cleanup completion rate based on whether the permission cleanup task has been completed when the connection is released; Identify the lag time when the reuse interval exceeds the permission cleanup cycle, mark the groups whose lag time exceeds the preset threshold and whose cleanup completion rate is lower than the standard value as high-risk groups, and extract the connection instances and their associated permission token residual features in the high-risk groups. Extract user identifiers and permission tokens from the request claim identity and actual execution identity corresponding to high-risk groups, assess the possibility of cross-user inheritance, and generate permission residual probability scores; The system matches periods when the probability score of residual permissions is higher than the threshold with periods of dense connection turnover, identifies peak points of high-frequency short connection turnover, and adjusts the identity consistency verification timing to within a preset time window before the peak point to obtain an optimized verification scheduling time point. Inject the filtering conditions of the residual high-privilege sessions at the optimized verification scheduling time point to identify abnormal sessions that trigger unauthorized updates due to temporary residual privileges. Based on the correspondence between the frequency of abnormal sessions and the current session reset granularity, shorten the cleanup execution cycle of the high-frequency residual privilege period to obtain the adjusted privilege cleanup execution cycle. The adjusted permission cleanup execution cycle is fed back to the database connection pool. The number of abnormal sessions detected before and after the adjustment is compared with the total number of sessions to evaluate the detection coverage of the blind spot and obtain the unauthorized update behavior detection report.

[0004] Furthermore, data on current connection reuse frequency and high-frequency short connection turnover are obtained from the database connection pool. Execution logs for session reset granularity and permission cleanup cycles are collected. The cleanup completion rate is determined based on whether the permission cleanup task has been completed when the connection is released, including: The unique connection identifier and historical reuse count of each connection are obtained from the metadata table of the database connection pool. The timestamp of the connection at the time of release and the timestamp of the time of reallocation are collected. The reuse interval duration is obtained by calculating the difference between the release time and the reallocation time. The system obtains the queue position and execution time record of the permission cleanup task in the task queue, reads whether the task has started execution and the assignment status of the completion flag from the cleanup status flag, and determines that the connection has permission cleanup lag by reading the cleanup status flag from the cleanup status flag. If the completion flag is still incomplete when the connection is reallocated, the system determines that the connection has permission cleanup lag. The cleanup completion rate is determined by calculating the proportion of the number of connections whose reuse interval is less than the execution time to the total number of connections.

[0005] Furthermore, the system identifies the lag time when the reuse interval exceeds the permission cleanup cycle, and marks groups with lag times exceeding a preset threshold and cleanup completion rates below a standard value as high-risk groups. It then extracts connection instances and their associated permission token remnant features from these high-risk groups, including: Read the reuse interval and permission cleanup cycle of each connection from the permission cleanup cycle execution log. Calculate the lag time by subtracting the permission cleanup cycle from the reuse interval. If the lag time is greater than zero, it indicates that the connection has a cleanup lag. Based on whether the lag time exceeds the preset first threshold, second threshold, and third threshold, it is divided into three risk levels: low, medium, and high, respectively, to obtain a preliminary assessment record containing the connection identifier and risk level. The K-means clustering algorithm is used to group the preliminary evaluation records according to two dimensions: lag time and cleanup completion. The number of clusters K is determined by rounding up the logarithm of the connection pool capacity. The mean lag time and mean cleanup completion of each group are obtained. If the mean lag time of a group exceeds a preset threshold and the mean cleanup completion is lower than a preset standard value, the group is assigned a high-risk group number. The high-risk group is determined by including the group number and all connection identifiers within the group. Extract the session token of each connection instance from the high-risk group, parse the user permission level, authorization scope and validity period information in the token, generate residual feature markers based on whether the token validity period has expired and whether the permission level is higher than the current requesting user level, and obtain the connection instance and its associated permission token residual features in the high-risk group.

[0006] Furthermore, the session token for each connection instance is extracted from the high-risk group, and the user permission level, authorization scope, and validity period information in the token are parsed, including: Read the storage address of the session token from the connection object corresponding to the high-risk group, and obtain the serialized byte stream of the token; The serialized byte stream is deserialized and parsed to extract the values ​​of the permission level field, authorization scope field, and validity period field; The values ​​of the permission level field, authorization scope field, and validity period field are stored in their respective key-value structures.

[0007] Furthermore, user identifiers and permission tokens are extracted from the request claim identity and actual execution identity corresponding to high-risk groups. The likelihood of cross-user inheritance is assessed, and a permission residual probability score is generated, including: Extract the user identifier and permission level of the requested identity from the connection logs of the high-risk group, read the operation user identifier and execution permission level recorded in the actual execution identity, and determine whether the user identifiers of the declared identity and the execution identity are consistent by comparing them. If they are inconsistent, calculate the permission level difference between the two identities to obtain the identity deviation record containing the user identifier pair and the permission level difference. Based on the connection identifier in the identity deviation record, query the switching time point of adjacent sessions, extract the permission token from the end time of the previous session, extract the permission token from the start time of the next session, and determine whether the two tokens are the same by comparing the hash values. If they are the same, they are marked as cross-session reuse. The inheritance risk value is obtained by multiplying the permission level difference by the reuse weight coefficient. Using a Bayesian probability algorithm, the inherited risk value is used as the prior probability, the cross-session reuse flag is used as the conditional event, and the token residual features of the high-risk group are used as the observation data to calculate the posterior probability that the previous user's permissions are inherited by the new request. The permission residual probability score is obtained by multiplying the inheritance risk value weight, reuse flag weight, and residual feature weight by the corresponding values ​​and then summing them.

[0008] Furthermore, the posterior probability of a previous user's permissions being inherited by a new request is calculated, specifically including: Construct an initial value for the prior probability P(inheritance) in the Bayesian formula, wherein the prior probability P(inheritance) is determined by the inheritance risk value; Obtain conditional probabilities P(reuse tag|inheritance) and P(residual feature|inheritance), wherein the conditional probabilities are obtained statistically from historical observation data; The posterior probability P(inheritance|reuse label, residual feature) is calculated based on the prior probability and the conditional probability.

[0009] Furthermore, by matching time periods where the residual permission probability score is higher than a threshold with periods of high connection turnover, peak points of high-frequency short connection turnover are identified, and the identity consistency verification timing is adjusted to within a preset time window before the peak point, resulting in optimized verification scheduling time points, including: Extract the start and end times of time periods with scores higher than the threshold from the time-series records of permission residual probability scores, obtain the intensive turnover periods in the connection pool monitoring log where the number of connection allocations per unit time exceeds the preset limit, identify the overlapping part of two time periods through time interval intersection operation, and obtain the time intervals of high risk and high load concurrency. Based on the connection turnover rate change curve within the time interval, a fixed-length sliding window is used to count the number of connection turnovers within the window. The turnover rate change rate is calculated by dividing the difference in turnovers between adjacent windows by the time interval. The moment when the change rate reaches its maximum value is determined as the peak point of high-frequency short connection turnover.

[0010] Furthermore, the timing of identity consistency verification will be adjusted to within a preset time window before the peak point, including: The verification start time is obtained by subtracting the sum of the identity verification execution time and the reserved buffer time from the peak time. The verification start time is determined as the optimized verification scheduling time point.

[0011] Furthermore, by injecting a filtering condition for residual high-privilege sessions at the optimized verification scheduling time point, abnormal sessions that trigger unauthorized updates due to temporary residual privileges are identified. Based on the correspondence between the frequency of abnormal session triggers and the current session reset granularity, the cleanup execution cycle for high-frequency residual privilege periods is shortened, resulting in the adjusted privilege cleanup execution cycle, including: When the identity verification process is started at the optimized verification scheduling time, a filtering condition for borrowing residual high-privilege sessions is added to the verification rule set. The filtering condition includes the judgment logic that the previous user's permission level is greater than the preset level threshold and the session token has not been cleared. By comparing the declared permission level of the current request with the user's actual authorization level stored in the database, if the declared level is higher than the authorization level, it is marked as a potential unauthorized request. Filter out sessions that successfully execute data updates beyond the authorized scope from requests with unauthorized flags, and count the number of such sessions per unit time to obtain the frequency of abnormal triggers; The adjustment coefficient is calculated based on the correspondence between the frequency of abnormal triggers and the granularity of the current session reset. The shortened period duration is obtained by dividing the base period duration by the adjustment coefficient, and the execution interval of the corresponding time period is updated to the shortened period duration.

[0012] This invention provides a data update security detection system, mainly comprising: The connection reuse and cleanup data collection module is used to obtain the current connection reuse frequency and high-frequency short connection turnover data from the database connection pool, collect the execution logs of session reset granularity and permission cleanup cycle, and determine the cleanup completion rate based on whether the permission cleanup task has been completed when the connection is released. The high-risk group marking and feature extraction module is used to identify the lag time when the reuse interval exceeds the permission cleanup cycle. Groups with a lag time exceeding a preset threshold and a cleanup completion rate lower than the standard value are marked as high-risk groups. The module also extracts the connection instances and their associated permission token residual features from the high-risk groups. The permission residual probability assessment module is used to extract user identifiers and permission tokens from the request claim identity and actual execution identity corresponding to high-risk groups, assess the possibility of cross-user inheritance, and generate permission residual probability scores. The verification scheduling time point optimization module is used to match the time period when the permission residual probability score is higher than the threshold with the time period when the connection turnover is dense, identify the peak point of high frequency short connection turnover, and adjust the identity consistency verification timing to within the preset time window before the peak point to obtain the optimized verification scheduling time point. The abnormal session identification and cleanup cycle adjustment module is used to inject the filtering conditions of the borrowed residual high-privilege sessions at the optimized verification scheduling time point, identify abnormal sessions that trigger unauthorized updates due to temporary residual privileges, and shorten the cleanup execution cycle of the high-frequency residual privilege period according to the correspondence between the abnormal trigger frequency of the abnormal session and the current session reset granularity, so as to obtain the adjusted privilege cleanup execution cycle. The detection effect evaluation and report generation module is used to feed back to the database connection pool according to the adjusted permission cleanup execution cycle, compare the number of abnormal sessions detected before and after the adjustment with the total number of sessions, evaluate the detection coverage of the detection blind spot, and obtain the unauthorized update behavior detection report.

[0013] The technical solutions provided by the embodiments of the present invention may include the following beneficial effects: This invention discloses a data update security detection method and system. By monitoring the lag relationship between connection reuse interval and permission cleanup cycle in real time, it identifies high-risk groups and extracts residual permission features. It further analyzes the cleanup interruption at the moment of connection release and reallocation, and evaluates the residence location of permission tokens and their cross-user inheritance probability. Combining the peak of request density with the timing optimization of identity consistency verification, it injects filtering conditions during critical periods, shortens the cleanup cycle and feeds back the connection pool strategy, ultimately reducing the proportion of abnormal sessions, improving the coverage of unauthorized behavior detection, and achieving a dynamic balance between connection reuse efficiency and permission security. Attached Figure Description

[0014] Figure 1 This is a flowchart of a data update security detection method according to the present invention.

[0015] Figure 2 This is a schematic diagram of a data update security detection method according to the present invention.

[0016] Figure 3 This is a schematic diagram of the structure of a data update security detection system according to the present invention. Detailed Implementation

[0017] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] like Figures 1-3This embodiment of a data update security detection method and system may specifically include: Step S101: Obtain the current connection reuse frequency and high-frequency short connection turnover data from the database connection pool, collect the execution logs of session reset granularity and permission cleanup cycle, and determine the cleanup completion rate based on whether the permission cleanup task has been completed when the connection is released.

[0019] The database connection pool's metadata table is used to obtain the unique connection identifier and historical reuse count for each connection. The timestamps of the connection's release and reallocation are collected. The reuse interval is calculated by the difference between the release and reallocation times. The current connection reuse frequency is determined based on the ratio of reuse count to monitoring period. The cleanup status flag is used to determine whether the task has started execution and the completion flag assignment. If the completion flag is still incomplete when the connection is reallocated, the connection is considered to have a permission cleanup lag. The cleanup completion rate is determined by calculating the proportion of connections with reuse intervals shorter than the permission cleanup period to the total number of connections. The token creation time and the user identifier of the token are extracted from the session token's metadata. For connection pool states where the cleanup completion rate is lower than a preset threshold, connections with permission cleanup lag and their corresponding session tokens are obtained. The difference between the token creation time and the current request arrival time is compared to determine if the token is a legacy from the previous session. A permission cleanup period execution log containing reuse interval, cleanup completion rate, and token residual status is obtained.

[0020] In one embodiment, the database connection pool's metadata table maintains the lifecycle information of each connection, where the connection identifier is stored in UUID format to ensure accurate tracking of specific connections even when the connection pool is expanded or shrunk. The reuse count is accumulated using an atomic counter, incrementing each time a connection transitions from an idle to an active state. The monitoring period is set to 300 seconds by default, and the connection reuse frequency is obtained by counting the reuse count within this period using a sliding window.

[0021] Specifically, the timestamps for release and allocation are accurate to the millisecond level, and the monotonically increasing time of the system clock is used to avoid clock rollback issues. The multiplexing interval is calculated by the difference between the two timestamps; when the interval is less than 100 milliseconds, it indicates that the connection is in a high-frequency multiplexing state. In the actual scenario of a university course selection system, the connection multiplexing interval on the first day of course selection may be shortened to less than 50 milliseconds.

[0022] It should be noted that the queuing position of the permission cleanup task in the task queue reflects the system load. The task queue is implemented using a priority queue, and the priority of the permission cleanup task is dynamically adjusted according to the connection reuse frequency. The execution time record includes two parts: the queuing time and the actual execution time. The cleanup status flag uses a three-state representation: not started, in progress, and completed.

[0023] In one possible implementation, the cleanup completion rate is calculated by considering the state of all connections within a time window. By traversing the active connections in the connection pool, the number of connections whose reuse interval is less than the execution time is counted. The ratio of this number to the total capacity of the connection pool is the inverse indicator of the cleanup completion rate, which is equal to 1 minus this ratio.

[0024] Preferably, during the metadata extraction process of the session token, the token creation time is obtained from the iat field of the JWT token, and the user identifier to which the token belongs is parsed from the sub field. A preset threshold is typically set to 70%; when the cleanup completion rate falls below this threshold, the system enters a high-risk state. The determination of the token residual status is based on whether the difference between the token creation time and the arrival time of the current request exceeds the session timeout duration, which is generally set to 1800 seconds in the academic affairs system.

[0025] For example, the permission cleanup cycle execution log is stored in a structured format, which includes the statistical distribution of reuse interval duration, the temporal changes in cleanup completion, and the detection results of token residual status.

[0026] Step S102: Identify the lag time when the reuse interval exceeds the permission cleanup cycle, mark the groups whose lag time exceeds the preset threshold and whose cleanup completion rate is lower than the standard value as high-risk groups, and extract the connection instances and their associated permission token residual features in the high-risk groups.

[0027] The reuse interval and permission cleanup cycle of each connection are read from the permission cleanup cycle execution log. The lag time is obtained by subtracting the permission cleanup cycle from the reuse interval. If the lag time is greater than zero, it indicates that the connection has a cleanup lag. Based on whether the lag time exceeds the preset first threshold, second threshold, and third threshold, the connection is divided into three risk levels: low, medium, and high, respectively, resulting in a preliminary assessment record containing the connection identifier and risk level. The K-means clustering algorithm is used to group the preliminary assessment records according to two dimensions: lag time and cleanup completion rate. The cleanup completion rate is defined as C = 1 - (R / E) for each connection, where C is the cleanup completion rate, R is the reuse interval, and E is the execution time. The number of clusters K is determined by rounding up the logarithm of the connection pool capacity. The average lag time and average cleanup completion rate of each group are obtained. If the average lag time of a group exceeds the preset threshold and the average cleanup completion rate is lower than the preset standard value, the group is assigned a high-risk group number. A high-risk group containing the group number and all connection identifiers within the group is determined. Extract the session token of each connection instance from the high-risk group, parse the user permission level, authorization scope and validity period information in the token, establish the association between the connection instance and the token information through hash mapping, and generate residual feature markers based on whether the token validity period has expired and whether the permission level is higher than the current requesting user level, so as to obtain the connection instance and its associated permission token residual features in the high-risk group.

[0028] In one embodiment, the lag time is calculated with millisecond precision. When the reuse interval is 150 milliseconds and the permission cleanup cycle is 200 milliseconds, the lag time is -50 milliseconds, indicating that permission cleanup can be completed before connection reuse. Risk level classification uses a three-tier threshold mechanism: the first threshold is set to 0 milliseconds, the second threshold to 50 milliseconds, and the third threshold to 100 milliseconds, corresponding to low, medium, and high risk levels, respectively.

[0029] Specifically, in the implementation of the K-means clustering algorithm, the number of clusters K is dynamically adjusted based on the connection pool capacity. When the connection pool capacity is 100, the value of K is calculated as log2(100) rounded up to obtain 7, which means all connections are divided into 7 groups. During algorithm initialization, K connections are randomly selected as initial cluster centers. In each iteration, each connection is assigned to the nearest cluster center according to the Euclidean distance, and then the center point of each group is recalculated until convergence or the maximum number of iterations of 500 is reached. The lag time and the cleanup completion degree are used as inputs to the two-dimensional feature vector, where the cleanup completion degree has been normalized to the interval between 0 and 1.

[0030] It should be noted that the determination of high-risk groups employs a dual-condition constraint. The preset threshold is typically set at 80 milliseconds, indicating that a delay exceeding this value is considered a severe lag; the preset standard value is set at 0.6, indicating that a completion rate below 60% is considered insufficient. Only groups meeting both conditions are assigned a high-risk label. In practical applications of university academic affairs systems, multiple high-risk groups often appear during peak periods for final grade inquiries.

[0031] In one possible implementation, the session token parsing process follows the JWT standard specification. The token payload includes the user permission level field (role), the authorization scope field (scope), and the expiration date field (exp). Permission levels are divided into three levels: student, teacher, and academic administrator, represented by the values ​​1, 2, and 3 respectively. The authorization scope defines a list of accessible resource paths, such as / grades / view indicating permission to view grades, and / grades / modify indicating permission to modify grades.

[0032] Preferably, the hash map is constructed using the connection identifier as the key and the token information structure as the value. The rule for generating the residual feature tag is as follows: if the timestamp of the token's validity period is less than the current system time, or the permission level value is greater than the permission level value of the current requesting user, then the residual feature tag is set to 1; otherwise, it is set to 0.

[0033] The startup status of the permission cleanup task and the progress of memory space reclamation are obtained from the connection release time. The arrival speed of new requests and the number of available connections in the connection pool are collected from the connection reallocation time. The situation where the connection is forcibly reclaimed when the permission cleanup task fails to complete cleanup due to the execution time exceeding the connection idle waiting time is analyzed. The situation where the connection pool shortens the connection idle waiting time to allocate connections that have not been cleaned up in advance due to insufficient available connections is evaluated. The residence location and data structure integrity of the permission token in the connection memory due to the interruption of the cleanup task are determined.

[0034] The start flag of the permission cleanup task is read from the monitoring log at the connection release time. The current progress percentage of the memory reclaimer is obtained, and the timestamp of the release time and the cleanup task process identifier are recorded. The process status table is queried to determine whether the cleanup task has been scheduled for execution. If the start flag is 1 and the reclamation progress is less than a preset threshold, the connection is marked as incomplete for cleanup, and a snapshot of the release time containing the connection identifier, cleanup status, reclamation progress, and release timestamp is obtained. The arrival rate of new requests per unit time is counted from the request queue at the connection reallocation time. The number of available connections in the pool is obtained by querying the connection pool manager. The connection idle waiting time is calculated based on the release timestamp in the release time snapshot and the timestamp of the current allocation time. The expected execution time of the cleanup task is compared with the connection idle waiting time. If the execution time is greater than the waiting time, a forced reclamation is determined to have occurred, and the memory scan offset of the cleanup task when the forced reclamation occurs is recorded. Based on the state where the number of available connections in the pool is lower than a preset lower limit, the behavior of the connection pool shortening the standard waiting time and prematurely allocating connections that have not been cleaned up is identified. The memory region being processed when the cleanup task was interrupted is determined from the memory scan offset. The starting address and occupied length of the permission token in the connection memory are located by using the memory layout map of the connection object, and the token residence location information is obtained. The length field and version identifier of the token header are read from the token residence location, and the actual data length is compared with the declared length to see if they are consistent. The boundary identifiers of each field of the token are parsed to verify whether there is overwriting or truncation between fields. If the length does not match or the boundary identifier is missing, it is determined that the structure is damaged, and the residence location of the permission token in the connection memory and the data structure integrity status are determined.

[0035] In one embodiment, constructing the release snapshot involves data collection from multiple monitoring points. The start flag uses a three-state mechanism: 0 indicates not started, 1 indicates running, and 2 indicates completed. The progress percentage of the memory reclaimer is calculated as the ratio of scanned memory pages to the total number of memory pages, with precision retained to two decimal places. The cleanup task process identifier uses a unique process ID assigned by the operating system, and its process status is read through the / proc file system. Status values ​​include R running, S sleeping, D uninterruptible sleeping, Z zombie, and T stopped. When the start flag is 1 and the reclamation progress is below 60%, it is marked as incomplete cleanup; at this point, although the connection has been released, permission information may still reside in memory.

[0036] It should be noted that the arrival rate of new requests is counted using a sliding window mechanism. The window size is set to 1 second, sliding once every 100 milliseconds to record the number of requests arriving within the window. During the first hour of course selection in the university's academic affairs system, the arrival rate can reach 500 requests per second. The number of available connections in the pool is maintained in real time using an atomic counter, decreasing each time a connection is allocated and increasing each time a connection is returned. The calculation of connection idle waiting time needs to consider the system clock accuracy, using a monotonic clock to avoid time callback issues.

[0037] Specifically, the forced reclamation decision is based on a time comparison mechanism. The expected execution time of the cleanup task is calculated using an exponential moving average algorithm based on historical data, with a weighting coefficient of 0.3, meaning the weight of a new sample is 0.3 and the weight of the historical average is 0.7. When the expected execution time is 120 milliseconds but the actual waiting time is only 80 milliseconds, the system determines that forced reclamation has occurred. The recorded memory scan offset at this time represents the number of bytes scanned when the cleanup task is interrupted. This offset is crucial for subsequently locating undone permission information. In a typical scenario of an academic affairs system, a complete permission cleanup cycle requires scanning approximately 4KB of connection object memory, and forced reclamation usually occurs when about 2KB has been scanned.

[0038] For example, the identification of pre-allocation behavior relies on a dynamic threshold adjustment mechanism. A preset lower limit for the number of available connections in the pool is dynamically adjusted based on system load, with a baseline value of 20% of the total connection pool capacity. When the number of available connections drops below this lower limit, the connection pool enters emergency mode, and the standard wait time is shortened from the default 200 milliseconds to 50 milliseconds. This shortening directly results in connections being released before cleanup tasks can complete. The process of converting memory scan offsets to specific memory addresses involves adding the offset to the base address of the connection object; the base address is obtained by looking up the connection identifier in the connection pool metadata table.

[0039] In one possible implementation, the memory layout of the connection object follows a fixed structure. The connection object header occupies 64 bytes and contains metadata such as connection identifier, creation time, and last used time; the middle section is a data buffer of 2048 bytes; and the tail is the permission information area, occupying 1024 bytes. The permission token is typically located at the beginning of the permission information area, and its starting address is calculated as base address + 64 + 2048. The token's length is determined based on the actual size after JWT encoding, typically between 200 and 500 bytes. The memory layout diagram is obtained through a symbol table generated at compile time, ensuring compatibility between different versions.

[0040] Preferably, the token structure integrity verification employs a multi-check mechanism. The token header contains a fixed magic number 0x4A575421 for quick identification of the token's starting position. The length field, stored in little-endian byte order in bytes 5 to 8 of the header, declares the total number of bytes in the token. The actual data length is determined by scanning to the next magic number or the boundary of a memory region. When the declared length differs from the actual length by more than 10 bytes, a length mismatch is determined.

[0041] Understandably, parsing field boundary identifiers involves Base64 encoding rules. A JWT token consists of a header, payload, and signature, separated by periods. The criterion for missing boundary identifiers is the absence of a period character within 5 bytes before and after the expected position. Field overlay detection is achieved by comparing the end and start positions of adjacent fields; if the end position of the preceding field is greater than the start position of the following field, overlay is considered. Field truncation identification is based on Base64 padding rules; if the payload lacks the expected equals sign padding character at the end, it is considered truncation. Furthermore, the data structure integrity status is represented by enumerated values: 0 for complete, 1 for abnormal length, 2 for missing boundaries, 3 for field overlay, 4 for field truncation, and 5 for multiple corruptions. This classification helps in taking targeted remedial measures. In the actual application of university campus card systems, approximately 15% of forced eviction scenarios result in token structure corruption, with abnormal length accounting for the highest proportion at 8%.

[0042] For example, during peak periods of final grade entry, academic administrators frequently perform batch operations, and a single connection may be reused more than 200 times within 10 minutes. When the system detects that a connection's token is located at 0x7F3A8B002890 and its structural integrity status is 2 (i.e., boundary missing), the system records this anomaly and triggers a deep cleanup mechanism. This mechanism thoroughly removes residual data by overwriting the entire permission information area, thereby preventing further expansion of the risk of permission leakage.

[0043] Step S103: Extract user identifiers and permission tokens from the request claim identity and actual execution identity corresponding to the high-risk group, assess the possibility of cross-user inheritance, and generate permission residual probability scores.

[0044] Extract the user identifier and permission level from the connection logs of high-risk groups, including the user identifier and permission level of the requested identity. Read the operation user identifier and execution permission level recorded in the actual execution identity. Compare the user identifiers of the claimed identity and the execution identity to determine if they match. If they do not match, calculate the permission level difference between the two identities to obtain an identity deviation record containing user identifier pairs and permission level differences. Query the switching time of adjacent sessions based on the connection identifier in the identity deviation record. Extract the permission token from the end time of the previous session and the start time of the next session. Compare the hash values ​​to determine if the two tokens are the same. If they are the same, mark it as cross-session reuse. Multiply the permission level difference by the reuse weight coefficient to obtain the inheritance risk value. A Bayesian probabilistic algorithm is used, with the inheritance risk value IRV as the prior probability, the cross-session reuse flag as the conditional event, and the token residual features of high-risk groups as the observation data. The posterior probability P of the previous user's permissions being inherited by the new request is calculated by multiplying the inheritance risk value weight W1 by IRV, the reuse flag weight W2 by RM (RM is 1 if reuse is not possible, otherwise it is 0), the residual feature weight W3 by RF (RF is a quantized value from 0 to 1), and the posterior probability weight W4 by P, and then summing the results. If the summation result exceeds the threshold of 0.8, it is determined that there is cross-user inheritance, and the permission residual probability score is obtained.

[0045] In one embodiment, the identity deviation record is constructed based on a two-factor authentication mechanism. The requested identity is extracted from the Authorization field of the HTTP request header, containing a Base64-encoded user identifier and permission level information. The actual execution identity is obtained from the database operation log, which records the database user and permissions used when actually executing SQL statements. The user identifier uses UUID format to ensure uniqueness, and the permission level is represented by integers: 1 for student, 2 for teacher, 3 for academic administrator, and 4 for system administrator.

[0046] Specifically, the identification of adjacent sessions relies on the temporal relationship of connections. The session switching time is determined through the connection state change log; when the connection state changes from ACTIVE to IDLE and then back to ACTIVE, the intermediate IDLE moment is the switching point. The hash value of the permission token is calculated using the SHA-256 algorithm to ensure the accuracy of the comparison. The formula for calculating the inheritance risk value is: the risk value equals the difference in permission levels multiplied by the reuse weight coefficient. The reuse weight coefficient is dynamically adjusted according to the connection idle time: the coefficient is 0.8 when the idle time is less than 100 milliseconds, 0.5 when it is between 100 and 500 milliseconds, and 0.2 when it exceeds 500 milliseconds.

[0047] It's important to note that the application of Bayesian probabilistic algorithms involves three key elements. The prior probability is the normalized value of the inherited risk, ranging from 0 to 1. The conditional event is a cross-session reuse flag; a flag of 1 indicates reuse has occurred, and 0 indicates no reuse. Observational data includes token residual features, such as the remaining token validity period, the number of permission ranges in the token, and the token signature integrity flag. The posterior probability is calculated using Bayes' theorem: .

[0048] In one possible implementation, the weighting coefficients are set using empirical tuning. The inheritance risk value weight is set to 0.4, reflecting the importance of differences in permission levels; the reuse tag weight is set to 0.3, reflecting the direct impact of session reuse on permission leakage; and the residual feature weight is set to 0.3, representing the contribution of the token state to the final judgment. The score obtained after weighted summation of the three factors ranges from 0 to 1, and the preset threshold is usually set to 0.7.

[0049] Preferably, the permission residual probability score is expressed on a percentage scale for easier and more intuitive understanding of the risk level. When the score exceeds 70, it is determined that there is a high probability of cross-user permission inheritance, triggering a forced permission reset mechanism. In the actual application of university academic affairs systems, the permission residual probability scores detected during peak periods of final grade inquiries are generally between 60 and 85, indicating that there is indeed a high risk of permission leakage during this period.

[0050] Obtain the authorized operation scope and resource access boundary corresponding to the identity declared in the new request, collect the operation type and resource path actually invoked by the new request from the connection execution record, evaluate the number of residual permission operations and the frequency of access to sensitive resources when the previous user's permission level is higher than the current user's permission level, and generate a permission residual probability score.

[0051] The authorized operation scope list and resource access boundary configuration are parsed from the identity declaration of the new request. The actual operation type and resource path accessed by the new request in the connection execution record are obtained. The coverage is obtained by checking whether each actual operation type exists in the authorized operation scope list and calculating the ratio of the number of successfully matched operations to the total number of actual operations. Path prefix matching is performed based on the resource path and the resource access boundary configuration. If the resource path is not within the path prefix range allowed by the boundary configuration, it is marked as an out-of-bounds access. The number of operations corresponding to the coverage being lower than a preset threshold is counted as the number of operations exceeding the authorized scope. The access frequency of sensitive resources is obtained by checking whether the resource path accessed out of bounds belongs to sensitive resources through a predefined list of sensitive resource paths and accumulating the access count. The permission level of the previous user and the permission level of the current user are extracted from the session switching log. If the permission level value of the previous user is greater than the permission level value of the current user, it is identified as a session switching scenario from high permission to low permission. Combining the number of operations exceeding the authorized scope, the frequency of sensitive resource access, and the session switching scenario type, the scenario identifier of the current connection with permission out-of-bounds risk is determined.

[0052] In one embodiment, the list of authorized operation scopes is stored in a tree structure, where each node represents a type of operation, and leaf nodes store specific operation identifiers. Resource access boundaries are configured using regular expressions to define allowed path patterns, such as ` / grades / ` representing grade-related resources and ` / students / / info` representing student personal information resources. The actual operation type is obtained from parsing SQL statements, including the four basic types: SELECT, INSERT, UPDATE, and DELETE, along with their corresponding table names and field name combinations.

[0053] Specifically, the calculation of coverage involves comparing two sets. The list of authorized operation scopes is converted into a set of operation identifiers, A, and the types of operations actually invoked are converted into a set of operation identifiers, B. The coverage is obtained by dividing the number of elements in the intersection of set A and set B by the total number of elements in set B. A coverage of 1 indicates that all actual operations are within the authorized scope, while a coverage of less than 0.8 indicates a potential violation of authorization.

[0054] It should be noted that path prefix matching uses the longest common prefix algorithm. Resource paths are divided into multi-level directories by slashes, and are matched against the path patterns in the boundary configuration level by level, starting from the root directory. The predefined list of sensitive resource paths includes financial data paths ( / finance / ), personal privacy paths ( / privacy / ), system configuration paths ( / system / config / *), etc. Sensitive resource access frequency is calculated based on the cumulative access count within a time window, with the window size set to 5 minutes.

[0055] In one possible implementation, session switching scenarios are identified based on connection state transition logs. Permission levels are encoded using integers: 1 for ordinary students, 2 for class leaders, 3 for instructors, 4 for academic administrators, and 5 for system administrators. When a permission level is detected to drop from 4 to 1, it is marked as a high-risk switching scenario. The scenario identifier is represented using a bitmap: bit 0 indicates whether access was out of bounds, bit 1 indicates whether access was to sensitive resources, and bit 2 indicates whether it was a switch from high to low privileges.

[0056] Preferably, the number of operations exceeding the authorized scope is cumulatively counted using a sliding window. Each unauthorized operation within the window increments the counter by 1. When the window slides out, the oldest operation record is removed, and the counter decreases accordingly. This mechanism reflects the recent density of unauthorized behavior and avoids interference from historical data in current judgments.

[0057] For example, in a university academic affairs system for entering final exam grades, the authorized operation scope of a teacher's account includes querying and modifying the grades of the courses they teach, and the resource access boundary is limited to the path / grades / course_id / *. When the system detects that the account attempts to access the path / grades / other_course / *, it identifies this as an out-of-bounds access and records the specific resource path involved and the access time.

[0058] Step S104: Match the time period when the permission residual probability score is higher than the threshold with the time period when the connection turnover is dense, identify the peak point of high frequency short connection turnover, and adjust the identity consistency verification timing to within the preset time window before the peak point to obtain the optimized verification scheduling time point.

[0059] Extract the start and end times of time periods with scores higher than the threshold from the time-series records of permission residual probability scores. Identify the high-volume turnaround periods in the connection pool monitoring logs where the number of connection allocations per unit time exceeds a preset upper limit. Use time interval intersection operations to identify the overlapping portions of two time periods, thus obtaining the high-risk and high-load concurrent time intervals. Based on the connection turnaround rate change curve within the time intervals, use a fixed-length sliding window to count the number of connection turnarounds within the window. Calculate the turnaround rate change rate by dividing the difference in turnarounds between adjacent windows by the time interval. The moment when the change rate turns from positive to negative is determined as the peak point of high-frequency short connection turnaround. Subtract the sum of the identity verification execution time and the reserved buffer time from the peak point time to obtain the verification start time. The reserved buffer time is determined based on the average historical verification delay. If the sum of the verification start time and the identity verification execution time is less than the peak point time, the verification start time is used as the optimized verification scheduling time point.

[0060] In one embodiment, the time-series records of permission residual probability scores are stored in a circular buffer, with each record containing a timestamp and the corresponding probability score. When the score exceeds a 70% threshold, the start and end times of that time period are recorded. The connection pool monitoring log counts the number of connection allocations per second; when the number of allocations per unit time exceeds 80% of the connection pool capacity, it is marked as a period of high turnover. The time interval intersection operation uses an interval tree data structure to achieve efficient querying. High-risk periods are represented as [start1, end1], high-density periods as [start2, end2], and the intersection interval is [max(start1, start2), min(end1, end2)]. When the length of the intersection interval is greater than zero, it indicates the existence of high-risk and high-load concurrency. In university academic affairs systems, this concurrency typically occurs in the first hour of course selection opening and on the first day of grade release.

[0061] Specifically, the fixed length of the sliding window is set to 300 seconds, and the window slides forward once every 60 seconds. The number of connection turnovers within the window is obtained by accumulating the connection allocation records within that time period. The turnover rate change rate is calculated using the difference method, that is, the turnover rate of the current window minus the turnover rate of the previous window, and then divided by the window sliding time interval of 60 seconds. The inflection point when the change rate changes from a positive value to a negative value is the peak point, at which point the connection turnover rate reaches a local maximum.

[0062] In one possible implementation, the reserved buffer duration is determined based on statistical analysis of historical verification latency data. The actual execution times of all identity verification tasks over the past 7 days are collected, and their average and standard deviation are calculated. The reserved buffer duration is set to the average latency plus twice the standard deviation, ensuring that over 95% of verification tasks can be completed before the peak. Identity verification execution time is typically 50 to 100 milliseconds, and the reserved buffer duration is generally set to 200 milliseconds.

[0063] Preferably, the calculation of the verification start time adopts a reverse calculation method. The theoretical completion time is obtained by subtracting the identity verification execution time from the peak time, and then the reserved buffer time is subtracted to obtain the actual start time. If the calculated start time is earlier than the current time, the verification is started immediately; if it is later than the current time, a timer is set to trigger the verification at that time.

[0064] For example, during the peak period of final grade inquiry, the system detects that a peak in connection turnover will occur at 10:30 am. The identity verification execution time is 80 milliseconds, and the reserved buffer time is 200 milliseconds. Therefore, the verification start time is set to 10:29:42 to ensure that the identity consistency verification of all connections is completed before the peak arrives.

[0065] By combining the time periods when the permission residual probability score is higher than the threshold and the time periods when the connection is immediately reassigned after being released, the request intensity is identified. The degree of cleanup lag is identified based on the time deviation between the execution status of the permission cleanup task and the moment the connection is released. The time point when the connection turnover speed reaches its extreme value in the time interval with the highest request intensity and the most severe cleanup lag is determined as the peak point of high-frequency short connection turnover.

[0066] The system reads connection turnaround timestamp sequences and session switching time records from real-time logs to identify the start and end periods when the permission residual probability score exceeds a preset threshold. It also collects rapid reconfiguration periods where the interval between connection release and reallocation is less than a preset interval threshold. A set of time periods requiring key monitoring is obtained through time interval union operations. The number of requests arriving per unit time window within the time period set is counted, and the ratio of the number of requests to the window duration is calculated to obtain the request density value. The difference between the completion time of the cleanup task and the corresponding connection release time is obtained from the permission cleanup task log; a difference greater than zero indicates cleanup lag. The ratio of the number of lags to the total number of cleanups is calculated to obtain the cleanup lag degree. The composite risk value for each time window is calculated based on the product of the request density value and the cleanup lag degree. The time window with the highest composite risk value is selected as the target interval. Within this interval, the number of connection allocations at each time point is calculated and divided by the statistical interval to obtain the connection turnaround speed V. The rate of change of V is then calculated. Where Δt is the time difference, Vt+1 is the connection turnover rate at time t+1, and Vt is the connection turnover rate at time t. The point where R turns from positive to negative is the peak point of high-frequency short connection turnover.

[0067] In one embodiment, the connection turnaround timestamp sequence is stored in a time-series database, with each record containing a connection identifier, operation type, and a timestamp accurate to milliseconds. Session switching times are determined by detecting the transition point from active to idle and back to active connection status. The threshold for the permission residual probability score is set to 75%; when the score exceeds this value, the start and end times of the corresponding time period are recorded. The determination of a fast reconfiguration period is based on the time interval between connection release and reallocation; an interval less than 100 milliseconds is considered a fast reconfiguration.

[0068] It should be noted that the time interval union operation is implemented using the scanline algorithm. All time periods are sorted by start and end times, and a counter records the number of currently overlapping time periods. When the counter goes from 0 to a positive number, the start of the union interval is marked; when it goes from a positive number to 0, the end is marked. This method can efficiently handle the merging of a large number of time periods and avoids repeatedly monitoring the same time period.

[0069] Specifically, request density is calculated using a sliding time window mechanism with a window size of 60 seconds, sliding every 10 seconds. The number of requests arriving within the window is obtained by accumulating the request log records for that time period, and the density value is equal to the number of requests divided by 60. The statistics for cleanup lag involve two key moments: the completion time of the permission cleanup task is extracted from the task execution log, and the connection release time is obtained from the connection pool state change record. When the cleanup completion time is later than the release time, it is recorded as a lag event, and the lag degree is equal to the ratio of the number of lag events to the total number of cleanup tasks.

[0070] In one possible implementation, the composite risk value is calculated using a weighted product method. The request density value is normalized to the range of 0 to 1, and the cleanup lag is already a ratio; multiplying the two yields the composite risk value. The system divides the monitoring period into multiple time windows, calculates the composite risk value for each window, and selects the window with the highest value as the key analysis interval.

[0071] Preferably, the connection turnaround speed is obtained through differential calculation. Within the target interval, the number of connection allocations within 500 milliseconds before and after each second is counted, and divided by 1 second to obtain the instantaneous turnaround speed. By comparing the speed values ​​at adjacent moments, the local maximum point of the speed curve is identified. When the speed value at a certain moment is greater than both the previous and subsequent moments, that point is the peak point.

[0072] For example, in the grade query scenario of a university's academic affairs system, between 10:00 AM and 11:00 AM, the request density reaches 300 requests per second, the cleanup lag is 40%, and the composite risk value is 0.12. The system detects that the connection turnaround speed reaches its peak at 10:35 AM, completing 150 connection allocations per second. This moment is identified as the peak point of high-frequency short connection turnaround.

[0073] Step S105: Inject the borrowed residual high-privilege session filtering condition at the optimized verification scheduling time point, identify abnormal sessions that trigger unauthorized updates due to temporary residual privileges, shorten the cleanup execution cycle of high-frequency residual privilege periods according to the correspondence between the abnormal trigger frequency of abnormal sessions and the current session reset granularity, and obtain the adjusted privilege cleanup execution cycle.

[0074] When the identity verification process is started at the optimized verification scheduling time, a filtering condition for borrowing residual high-privilege sessions is added to the verification rule set. The filtering condition includes the judgment logic that the previous user's permission level is greater than a preset level threshold and the session token has not been cleared. By comparing the declared permission level of the current request with the user's actual authorization level stored in the database, if the declared level is higher than the authorized level, it is marked as a potential unauthorized request, resulting in a request queue containing unauthorized requests. Requests with unauthorized requests are filtered from the request queue, and the session identifier and operation type associated with these requests are obtained. The operation log is queried to determine whether a data update operation exceeding the authorized scope was successfully executed. If the execution is successful, it is confirmed as an unauthorized update abnormal session triggered by temporary permission residue. The number of abnormal sessions per unit time is counted to obtain the abnormal trigger frequency. The adjustment intensity level is determined based on the abnormal trigger frequency, and the value of the current session reset granularity is obtained. The reset granularity uses an integer to represent the subdivision level of session cleanup. The adjustment coefficient is obtained by dividing the abnormal trigger frequency by a preset base frequency and then multiplying by the granularity adjustment factor. If the adjustment coefficient exceeds a preset upper limit, the upper limit value is used. The time period when the abnormal trigger frequency exceeds the threshold is identified as the high-frequency permission residue period. The baseline cycle length is read from the current permission cleanup execution cycle configuration. For the high-frequency permission residual period, the baseline cycle length is divided by the adjustment coefficient to obtain the shortened cycle length. The execution interval of the corresponding period in the cleanup task scheduling table is updated to the shortened cycle length to obtain the adjusted permission cleanup execution cycle.

[0075] In one embodiment, after the optimized verification scheduling time is determined through preliminary steps, the system triggers the identity verification procedure at that time. The verification rule set is stored using a chained rule structure, with each rule containing a condition part and an action part. Residual high-privilege session filtering conditions are used as new rules and inserted at the beginning of the rule chain to ensure priority execution. The judgment logic for the filtering conditions includes two core elements: the previous user's permission level is obtained by querying the session history, with a permission level threshold set to 3, corresponding to the academic administrator level; the session token clearing status is determined by checking whether the corresponding position in the token storage area is empty. The declared permission level of the current request is obtained by parsing the authentication field in the HTTP request header, and the user's actual authorized level is queried from the user permission table.

[0076] It should be noted that the potential unauthorized request marking mechanism is implemented using a bitmap. Each request is assigned a 32-bit flag field, with bit 0 indicating an abnormal permission level, bit 1 indicating token remnant, and bit 2 indicating session reuse. When the declared permission level value is greater than the authorized permission level value, bit 0 is set to 1. The request queue is implemented using a priority queue, with requests having more unauthorized permission flags having higher priority and being processed first. In university academic affairs systems, such unauthorized requests typically occur when a teacher's account is quickly taken over by a student's account.

[0077] Specifically, the confirmation process for abnormal sessions involves multiple layers of verification. The session identifier is obtained by parsing the `session_id` field in the request, and the operation type is extracted from the keywords of the SQL statement, including SELECT, INSERT, UPDATE, and DELETE. Operation log queries use time window filtering, only querying records from the last 5 minutes. The success of a data update operation is determined based on two conditions: the number of affected rows returned by the SQL statement execution is greater than 0, and the transaction commit status is successful. Temporary privilege remnant triggers are characterized by the operator's actual privileges being insufficient to execute the operation, but the operation is successfully executed due to a high-privilege token remaining in the connection. The frequency of abnormal triggers is statistically analyzed using a sliding time window with a window size of 300 seconds, and the count is updated every 60 seconds.

[0078] In one possible implementation, the adjustment intensity levels are divided into three levels: low, medium, and high, corresponding to anomaly trigger frequencies of less than 5 times / minute, 5-15 times / minute, and greater than 15 times / minute, respectively. Session reset granularity is represented by integers from 1 to 10, with larger values ​​indicating more thorough cleanup. Granularity 1 cleans only the permission token, granularity 5 cleans both the token and session variables, and granularity 10 cleans the entire session context. The base frequency is set to 10 times / minute, and the granularity adjustment factor is dynamically adjusted based on system load: 1.0 for low load and 1.5 for high load. The adjustment coefficient is calculated as follows: coefficient equals anomaly trigger frequency divided by the base frequency multiplied by the granularity adjustment factor. A preset upper limit of 5 is set to prevent excessively shortened cleanup cycles from exhausting system resources.

[0079] Preferably, the identification of high-frequency permission residual periods adopts a threshold comparison method. When the frequency of abnormal triggers within a certain period exceeds a preset threshold of 15 times / minute for three consecutive statistical windows, the period is marked as a high-frequency period. The start time of the period is the moment when the threshold is first exceeded, and the end time is the moment when the frequency is below the threshold for three consecutive windows. This identification method can avoid misjudgment caused by occasional frequency fluctuations.

[0080] For example, the baseline period length is configured in a tiered manner. The baseline period is 600 seconds during normal periods, 300 seconds during peak business periods, and 1200 seconds during late-night off-peak periods. The calculation of the shortened period length follows a minimum limit of 30 seconds to avoid excessively frequent cleanup operations affecting normal business operations. The cleanup task scheduling table is organized using a red-black tree structure and sorted by execution time for easy searching and updating.

[0081] Understandably, the execution of update operations involves atomicity guarantees. First, the corresponding time period record in the scheduling table is locked, the execution interval field is modified, then the next execution time is updated, and finally the lock is released. This mechanism ensures data consistency during concurrent updates. Furthermore, the adjusted permission cleanup execution cycle is distributed to each execution node through the configuration center. Each node maintains a local cache and periodically synchronizes with the configuration center. When a change in the cycle configuration is detected, the node recalculates the execution plan for the cleanup task. In the actual application of the university's academic affairs system, during the final grade entry period, the system detected 20 abnormal triggers per minute. The adjustment coefficient was calculated to be 3.0, shortening the original 600-second cleanup cycle to 200 seconds, effectively reducing the risk of permission residue.

[0082] For example, in a university's course selection system, during the first hour of course selection from 9:00 AM to 10:00 AM, the system detected an abnormal trigger frequency of 25 times per minute. With a reset granularity of 7, the calculated adjustment coefficient was 3.75. The original baseline period of 300 seconds divided by 3.75 yielded a shortened period of 80 seconds. The system automatically adjusted the execution interval of the cleanup task during this period to 80 seconds, a 73% reduction compared to the original period, significantly improving the timeliness of permission cleanup.

[0083] Step S106: Feedback is sent to the database connection pool according to the adjusted permission cleanup execution cycle. The number of abnormal sessions detected before and after the adjustment is compared with the total number of sessions. The detection coverage of the detection blind spot is evaluated, and an unauthorized update behavior detection report is obtained.

[0084] An update request is sent to the database connection pool according to the adjusted permission cleanup execution cycle. A new cleanup trigger interval is set through the connection pool configuration interface. The number of abnormal sessions detected and the total number of sessions before the configuration update are recorded. Within the same time period after the configuration takes effect, the number of abnormal sessions detected and the total number of sessions are counted again to obtain two sets of detection data before and after the adjustment. The detection ratio is calculated separately. The detection ratio before the adjustment is equal to the number of abnormal sessions before the adjustment divided by the total number of sessions before the adjustment. The detection ratio after the adjustment is equal to the number of abnormal sessions after the adjustment divided by the total number of sessions after the adjustment. The detection coverage improvement value is obtained by subtracting the detection ratio before the adjustment from the detection ratio after the adjustment. The session identifier, user identity, unauthorized operation type and occurrence time information are extracted from the abnormal session log and summarized to form an unauthorized update behavior detection report containing the detection coverage value.

[0085] In one embodiment, the update of the permission cleanup execution cycle is implemented by calling the REST API interface of the connection pool. The update request is encapsulated in JSON format and includes parameters such as the cleanup interval, effective time, and applicable connection range. After receiving the request, the connection pool updates its internal scheduler configuration and returns a configuration version number for subsequent tracking.

[0086] It should be noted that the choice of statistical duration has a significant impact on the evaluation results. Typically, a two-hour window during peak business hours is selected as the statistical window to ensure a sufficient sample size. Data before adjustment is extracted from historical logs, while data after adjustment is obtained through real-time monitoring. The number of abnormal sessions detected is obtained by counting sessions marked with an unauthorized access flag; the total number of sessions includes all successfully established database sessions.

[0087] Specifically, the detection rate is calculated using a percentage system. If the detection rate was 15% before the adjustment and increases to 23% after the adjustment, the detection coverage rate increases by 8 percentage points. The unauthorized update behavior detection report uses a structured format, including five parts: statistical period, number of detections before and after the adjustment, comparison of detection rates, typical unauthorized behavior cases, and risk level assessment. The session identifier in the report uses UUID format, and the user identity includes the username and assigned role. Unauthorized operation types are categorized into three types based on database operations: query unauthorized, update unauthorized, and delete unauthorized, with the occurrence time accurate to the second.

[0088] This invention provides a data update security detection system, mainly comprising: The connection reuse and cleanup data collection module is used to obtain the current connection reuse frequency and high-frequency short connection turnover data from the database connection pool, collect the execution logs of session reset granularity and permission cleanup cycle, and determine the cleanup completion rate based on whether the permission cleanup task has been completed when the connection is released. The high-risk group marking and feature extraction module is used to identify the lag time when the reuse interval exceeds the permission cleanup cycle. Groups with a lag time exceeding a preset threshold and a cleanup completion rate lower than the standard value are marked as high-risk groups. The module also extracts the connection instances and their associated permission token residual features from the high-risk groups. The permission residual probability assessment module is used to extract user identifiers and permission tokens from the request claim identity and actual execution identity corresponding to high-risk groups, assess the possibility of cross-user inheritance, and generate permission residual probability scores. The verification scheduling time point optimization module is used to match the time period when the permission residual probability score is higher than the threshold with the time period when the connection turnover is dense, identify the peak point of high frequency short connection turnover, and adjust the identity consistency verification timing to within the preset time window before the peak point to obtain the optimized verification scheduling time point. The abnormal session identification and cleanup cycle adjustment module is used to inject the filtering conditions of the borrowed residual high-privilege sessions at the optimized verification scheduling time point, identify abnormal sessions that trigger unauthorized updates due to temporary residual privileges, and shorten the cleanup execution cycle of the high-frequency residual privilege period according to the correspondence between the abnormal trigger frequency of the abnormal session and the current session reset granularity, so as to obtain the adjusted privilege cleanup execution cycle. The detection effect evaluation and report generation module is used to feed back to the database connection pool according to the adjusted permission cleanup execution cycle, compare the number of abnormal sessions detected before and after the adjustment with the total number of sessions, evaluate the detection coverage of the detection blind spot, and obtain the unauthorized update behavior detection report.

[0089] If the technical solution of this application involves personal information, the product using this solution has clearly informed the user of the personal information processing rules and obtained the user's voluntary consent before processing the personal information. If sensitive personal information is involved, the user's separate consent has been obtained before processing, and the "express consent" requirement is met. For example, a clear sign is placed at the collection device such as a camera to inform the user that they have entered the collection area, and the user's voluntary entry is considered as consent; or the processing device clearly indicates the processing rules and obtains authorization through pop-up windows or by asking the user to upload information themselves. The personal information processing rules include the processor, the purpose of processing, the processing method, and the types of personal information.

[0090] The above description is merely a preferred embodiment of this application and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of the invention involved in this application is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the concept of this application. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this application.

Claims

1. A data update security detection method, characterized in that, The method includes: Obtain current connection reuse frequency and high-frequency short connection turnover data from the database connection pool, collect execution logs of session reset granularity and permission cleanup cycle, and determine the cleanup completion rate based on whether the permission cleanup task has been completed when the connection is released; Identify the lag time when the reuse interval exceeds the permission cleanup cycle, mark the groups whose lag time exceeds the preset threshold and whose cleanup completion rate is lower than the standard value as high-risk groups, and extract the connection instances and their associated permission token residual features in the high-risk groups. Extract user identifiers and permission tokens from the request claim identity and actual execution identity corresponding to high-risk groups, assess the possibility of cross-user inheritance, and generate permission residual probability scores; The system matches periods when the probability score of residual permissions is higher than the threshold with periods of dense connection turnover, identifies peak points of high-frequency short connection turnover, and adjusts the identity consistency verification timing to within a preset time window before the peak point to obtain an optimized verification scheduling time point. Inject the filtering conditions of the residual high-privilege sessions at the optimized verification scheduling time point to identify abnormal sessions that trigger unauthorized updates due to temporary residual privileges. Based on the correspondence between the frequency of abnormal sessions and the current session reset granularity, shorten the cleanup execution cycle of the high-frequency residual privilege period to obtain the adjusted privilege cleanup execution cycle. The adjusted permission cleanup execution cycle is fed back to the database connection pool. The number of abnormal sessions detected before and after the adjustment is compared with the total number of sessions to evaluate the detection coverage of the blind spot and obtain the unauthorized update behavior detection report.

2. The data update security detection method according to claim 1, characterized in that, The process involves obtaining current connection reuse frequency and high-frequency short connection turnover data from the database connection pool, collecting execution logs for session reset granularity and permission cleanup cycles, and determining the cleanup completion rate based on whether the permission cleanup task has been completed when the connection is released. This includes: The unique connection identifier and historical reuse count of each connection are obtained from the metadata table of the database connection pool. The timestamp of the connection at the time of release and the timestamp of the time of reallocation are collected. The reuse interval duration is obtained by calculating the difference between the release time and the reallocation time. The system retrieves the queue position and execution time of the permission cleanup task in the task queue, reads whether the task has started execution and the assignment of the completion flag from the cleanup status flag, and determines that the connection has permission cleanup lag by reading the completion flag from the cleanup status flag.

3. The data update security detection method according to claim 1, characterized in that, The identification and reuse interval duration exceeds the lag time of the permission cleanup cycle. Groups with lag times exceeding a preset threshold and cleanup completion rates below a standard value are marked as high-risk groups. Connection instances and their associated permission token residual features in high-risk groups are extracted, including: Read the reuse interval and permission cleanup cycle of each connection from the permission cleanup cycle execution log. Calculate the lag time by subtracting the permission cleanup cycle from the reuse interval. If the lag time is greater than zero, it indicates that the connection has a cleanup lag. Based on whether the lag time exceeds the preset first threshold, second threshold, and third threshold, it is divided into three risk levels: low, medium, and high, respectively, to obtain a preliminary assessment record containing the connection identifier and risk level. The K-means clustering algorithm is used to group the preliminary evaluation records according to two dimensions: lag time and cleanup completion. The number of clusters K is determined by rounding up the logarithm of the connection pool capacity. The mean lag time and mean cleanup completion of each group are obtained. If the mean lag time of a group exceeds a preset threshold and the mean cleanup completion is lower than a preset standard value, the group is assigned a high-risk group number. The high-risk group is determined by including the group number and all connection identifiers within the group. Extract the session token of each connection instance from the high-risk group, parse the user permission level, authorization scope and validity period information in the token, generate residual feature markers based on whether the token validity period has expired and whether the permission level is higher than the current requesting user level, and obtain the connection instance and its associated permission token residual features in the high-risk group.

4. The data update security detection method according to claim 3, characterized in that, The process of extracting the session token for each connection instance from the high-risk group and parsing the user permission level, authorization scope, and validity period information in the token includes: Read the storage address of the session token from the connection object corresponding to the high-risk group, and obtain the serialized byte stream of the token; The serialized byte stream is deserialized and parsed to extract the values ​​of the permission level field, authorization scope field, and validity period field; The values ​​of the permission level field, authorization scope field, and validity period field are stored in their respective key-value structures.

5. The data update security detection method according to claim 1, characterized in that, The process of extracting user identifiers and permission tokens from the request claim identity and actual execution identity corresponding to high-risk groups, assessing the likelihood of cross-user inheritance, and generating a permission residual probability score includes: Extract the user identifier and permission level of the requested identity from the connection logs of the high-risk group, read the operation user identifier and execution permission level recorded in the actual execution identity, and determine whether the user identifiers of the declared identity and the execution identity are consistent by comparing them. If they are inconsistent, calculate the permission level difference between the two identities to obtain the identity deviation record containing the user identifier pair and the permission level difference. Based on the connection identifier in the identity deviation record, query the switching time point of adjacent sessions, extract the permission token from the end time of the previous session, extract the permission token from the start time of the next session, and determine whether the two tokens are the same by comparing the hash values. If they are the same, they are marked as cross-session reuse. The inheritance risk value is obtained by multiplying the permission level difference by the reuse weight coefficient. Using a Bayesian probability algorithm, the inherited risk value is used as the prior probability, the cross-session reuse flag is used as the conditional event, and the token residual features of the high-risk group are used as the observation data to calculate the posterior probability that the previous user's permissions are inherited by the new request. The permission residual probability score is obtained by multiplying the inheritance risk value weight, reuse flag weight, and residual feature weight by the corresponding values ​​and then summing them.

6. The data update security detection method according to claim 5, characterized in that, Calculating the posterior probability that previous user permissions are inherited by a new request includes: Construct an initial value for the prior probability P(inheritance) in the Bayesian formula, wherein the prior probability P(inheritance) is determined by the inheritance risk value; Obtain conditional probabilities P(reuse tag|inheritance) and P(residual feature|inheritance), wherein the conditional probabilities are obtained statistically from historical observation data; The posterior probability P(inheritance|reuse label, residual feature) is calculated based on the prior probability and the conditional probability.

7. The data update security detection method according to claim 1, characterized in that, The period when the residual probability score of the matching permission is higher than the threshold and the period when connection turnover is dense are identified. The peak points of high-frequency short connection turnover are identified, and the identity consistency verification timing is adjusted to within a preset time window before the peak point to obtain the optimized verification scheduling time point, including: Extract the start and end times of time periods with scores higher than the threshold from the time-series records of permission residual probability scores, obtain the intensive turnover periods in the connection pool monitoring log where the number of connection allocations per unit time exceeds the preset limit, identify the overlapping part of two time periods through time interval intersection operation, and obtain the time intervals of high risk and high load concurrency. Based on the connection turnover rate change curve within the time interval, a fixed-length sliding window is used to count the number of connection turnovers within the window. The turnover rate change rate is calculated by dividing the difference in turnovers between adjacent windows by the time interval. The moment when the change rate reaches its maximum value is determined as the peak point of high-frequency short connection turnover.

8. The data update security detection method according to claim 1, characterized in that, The step of adjusting the timing of identity consistency verification to within a preset time window before the peak point includes: The verification start time is obtained by subtracting the sum of the identity verification execution time and the reserved buffer time from the peak time. The verification start time is determined as the optimized verification scheduling time point.

9. The data update security detection method according to claim 1, characterized in that, The process involves injecting a filtering condition for residual high-privilege sessions at the optimized verification scheduling time point to identify abnormal sessions that trigger unauthorized updates due to temporary residual privileges. Based on the correspondence between the frequency of abnormal session triggers and the current session reset granularity, the cleanup execution cycle for high-frequency residual privilege periods is shortened, resulting in the adjusted privilege cleanup execution cycle, which includes: When the identity verification process is started at the optimized verification scheduling time, a filtering condition for borrowing residual high-privilege sessions is added to the verification rule set. The filtering condition includes the judgment logic that the previous user's permission level is greater than the preset level threshold and the session token has not been cleared. By comparing the declared permission level of the current request with the user's actual authorization level stored in the database, if the declared level is higher than the authorization level, it is marked as a potential unauthorized request. Filter out sessions that successfully execute data updates beyond the authorized scope from requests with unauthorized flags, and count the number of such sessions per unit time to obtain the frequency of abnormal triggers; The adjustment coefficient is calculated based on the correspondence between the frequency of abnormal triggers and the granularity of the current session reset. The shortened period duration is obtained by dividing the base period duration by the adjustment coefficient, and the execution interval of the corresponding time period is updated to the shortened period duration.

10. A data update security detection system, characterized in that, The system includes: The connection reuse and cleanup data collection module is used to obtain the current connection reuse frequency and high-frequency short connection turnover data from the database connection pool, collect the execution logs of session reset granularity and permission cleanup cycle, and determine the cleanup completion rate based on whether the permission cleanup task has been completed when the connection is released. The high-risk group marking and feature extraction module is used to identify the lag time when the reuse interval exceeds the permission cleanup cycle. Groups with a lag time exceeding a preset threshold and a cleanup completion rate lower than the standard value are marked as high-risk groups. The module also extracts the connection instances and their associated permission token residual features from the high-risk groups. The permission residual probability assessment module is used to extract user identifiers and permission tokens from the request claim identity and actual execution identity corresponding to high-risk groups, assess the possibility of cross-user inheritance, and generate permission residual probability scores. The verification scheduling time point optimization module is used to match the time period when the permission residual probability score is higher than the threshold with the time period when the connection turnover is dense, identify the peak point of high frequency short connection turnover, and adjust the identity consistency verification timing to within the preset time window before the peak point to obtain the optimized verification scheduling time point. The abnormal session identification and cleanup cycle adjustment module is used to inject the filtering conditions of the borrowed residual high-privilege sessions at the optimized verification scheduling time point, identify abnormal sessions that trigger unauthorized updates due to temporary residual privileges, and shorten the cleanup execution cycle of the high-frequency residual privilege period according to the correspondence between the abnormal trigger frequency of the abnormal session and the current session reset granularity, so as to obtain the adjusted privilege cleanup execution cycle. The detection effect evaluation and report generation module is used to feed back to the database connection pool according to the adjusted permission cleanup execution cycle, compare the number of abnormal sessions detected before and after the adjustment with the total number of sessions, evaluate the detection coverage of the detection blind spot, and obtain the unauthorized update behavior detection report.

Images