Data leakage risk identification method and system based on multi-dimensional trajectory graph

Abstract

The application belongs to the technical field of network security and trajectory graph analysis, and specifically discloses a data leakage risk identification method and system based on a multi-dimensional trajectory graph, which comprises the following steps: extracting database message execution plan features and source end identification to generate semantic fingerprints; performing affinity grouping by using the semantic fingerprints, and aggregating continuous operations into macro nodes with weights in a time window dynamically adjusted by a back pressure signal; pushing macro node trajectory edges into a lock-free ring buffer to assemble a chain and feed back a water level; monitoring macro node weights and data output streams, calculating information entropy of output data when a trigger condition is met and external writing occurs; if the entropy value indicates an encrypted stream and there is a derivative relationship between an external sending process and an access process, generating an entropy change conversion edge in the graph, and accordingly implementing blocking and alarming. The application realizes accurate tracing and effective interception of a full link from sensitive data reading to encrypted leakage.

Description

Technical Field

[0001] This invention belongs to the field of network security and trajectory mapping analysis technology, and relates to a method and system for identifying data leakage risks based on multi-dimensional trajectory mapping. Background Technology

[0002] Database interaction messages carry structured query requests and responses between applications and database systems, serving as a crucial form of data flow. In the field of information security, database-oriented data breach prevention products are typically deployed at network egress points or on the database server side. They reconstruct user data access behavior by analyzing database communication protocols and, combined with content auditing and behavioral baselines, identify abnormal database access and data outflow activities. Multidimensional analysis is one of the core technical requirements of these products; its goal is to connect isolated events into a complete operational trajectory, thereby supporting tracing and evidence collection.

[0003] A common technical solution in the current field is to deploy a traffic mirroring and parsing module at the database gateway layer. This module groups the parsed SQL operations at the session level according to dimensions such as client IP, session identifier, or database user, and sets a fixed time window to count similar operations. When the count exceeds a preset threshold, an alarm is triggered. Some solutions also perform compression ratio or byte distribution checks on the transmitted data at the file or network output layer to determine whether it is an encrypted executable file or compressed package, preventing unauthorized leakage of ciphertext.

[0004] However, most existing solutions directly hash and group the original SQL statements carrying specific parameter values. This results in the same query template being split into different groups due to parameter changes, making it impossible to effectively aggregate similar operations in high-frequency access scenarios, leading to a sharp increase in subsequent analysis dimensions. Furthermore, existing solutions typically use fixed thresholds for operation aggregation, lacking a feedback coordination mechanism with the processing capabilities of downstream analysis components. This can easily cause memory bloat or detection omissions under sudden high loads. In addition, traditional methods often analyze database operations and file or network output behavior separately, lacking a unified modeling method for operation trajectories, process derivation relationships, and the encryption characteristics of outgoing data. This makes it difficult to construct a complete path from data access to encrypted leakage, allowing attackers to bypass monitoring by exploiting process derivation and data encryption techniques. Summary of the Invention

[0005] In order to overcome the above-mentioned defects of the prior art and to achieve the above objectives, the present invention proposes the following technical solution: a data leakage risk identification method based on multi-dimensional trajectory graphs, comprising: S1, acquiring database interaction messages, extracting semantic features representing the semantics of operations in the messages, and generating semantic fingerprints by combining the message source identifier.

[0006] S2. Based on semantic fingerprints, the messages are grouped by affinity, and consecutive operations with the same semantic fingerprints are aggregated into weighted macro nodes within a dynamically adjusted merging time window, wherein the duration of the merging time window is controlled by the back pressure signal.

[0007] S3. Push the trajectory edges associated with the macro nodes into the lock-free circular buffer, assemble them into a trajectory edge chain in the lock-free circular buffer, and generate a back pressure signal based on the lock-free circular buffer's own occupancy status, which is then fed back to the aggregation step.

[0008] S4. Monitor the weight attributes of macro nodes and the data output stream pointed to by the trajectory edge chain. When the cumulative weight of the macro node exceeds the preset risk weight benchmark, and the object resource type pointed to by the data output stream belongs to the external medium type set, and the data output stream is an external write operation, perform information entropy calculation on the data block to be output corresponding to the macro node to obtain the entropy value evaluation result.

[0009] S5. When the entropy evaluation result indicates an encrypted stream and the process performing the external write operation has a derivation relationship with the process accessing the macro node, add an entropy transformation edge from the macro node to the corresponding high-entropy data block in the multidimensional trajectory graph, and generate a data leakage risk alarm based on the entropy transformation edge.

[0010] The second aspect of the present invention provides a data leakage risk identification system based on multidimensional trajectory graphs, comprising: a semantic fingerprint extraction module, used to acquire database interaction messages, extract semantic features representing operation semantics from the messages, and generate a semantic fingerprint by combining the message source identifier.

[0011] An adaptive aggregation module is used to group packets based on semantic fingerprints according to affinity, and to aggregate consecutive operations with the same semantic fingerprint into weighted macro nodes within a dynamically adjusted merging time window, wherein the duration of the merging time window is controlled by a backpressure signal.

[0012] The trajectory edge chain assembly module is used to push the trajectory edges associated with macro nodes into the lock-free circular buffer, assemble them into a trajectory edge chain in the lock-free circular buffer, and generate a back pressure signal based on the lock-free circular buffer's own occupancy status, which is then fed back to the aggregation step.

[0013] The directional entropy detection module is used to monitor the weight attributes of macro nodes and the data output stream pointed to by the trajectory edge chain. When the cumulative weight of the macro node exceeds the preset risk weight benchmark, and the object resource type pointed to by the data output stream belongs to the external medium type set, and the data output stream is an external write operation, the information entropy calculation is performed on the data block to be output corresponding to the macro node to obtain the entropy evaluation result.

[0014] The graph tracing alarm module is used to add an entropy transformation edge from the macro node to the corresponding high-entropy data block in the multidimensional trajectory graph when the entropy value evaluation result indicates an encrypted stream and the process performing the external write operation has a derivation relationship with the process accessing the macro node, and generate a data leakage risk alarm based on the entropy transformation edge.

[0015] Compared with the prior art, the beneficial effects of the present invention are as follows: (1) The present invention extracts the execution plan features after stripping the variable parameters of the database interaction message and generates semantic fingerprints by hashing them together with the source network identifier, so that messages with the same operation semantics are accurately converged to the same processing thread, which solves the problem of semantic fragmentation caused by parameter differences in high-frequency repeated query scenarios, and provides accurate and deduplicated access behavior primitives for subsequent aggregation analysis.

[0016] (2) This invention utilizes the water level status of the lockless ring buffer to dynamically adjust the length of the merging time window. Under high load conditions, it adaptively expands the aggregation granularity to reduce the processing pressure on the downstream trajectory edge, and under low load conditions, it shrinks the window to maintain low latency response. This achieves self-balancing processing capability in a throughput fluctuation environment and effectively avoids data loss and processing delay accumulation caused by buffer overflow.

[0017] (3) This invention incorporates the macro node aggregation weight, object resource type, sensitive field mark and information entropy criterion of data output stream into a unified multidimensional trajectory graph, and verifies the entropy transformation edge through process derivation relationship verification. It can depict the complete leakage link from reading sensitive data from the database to encrypted external transmission, and overcomes the limitation of traditional methods that can only detect a single abnormal behavior and cannot restore the whole picture of data flow.

[0018] (4) After determining the encrypted leakage path, the present invention directly calls the network protocol stack driver interface to issue a connection reset blocking command, realizing a closed-loop processing from risk identification to active interception, compressing the response delay of alarm and blocking to the millisecond level, and providing the security operation center with an accurate event entity that can immediately execute physical-level alarms. Attached Figure Description

[0019] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a schematic diagram of the implementation steps of the method of the present invention.

[0021] Figure 2 This is a schematic diagram of the system module connections of the present invention. Detailed Implementation

[0022] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0023] Please see Figure 1 As shown, the data leakage risk identification method based on multi-dimensional trajectory graph proposed in this invention includes: S1, obtaining database interaction messages, extracting semantic features representing operation semantics in the messages, and generating semantic fingerprints by combining the message source identifier.

[0024] In a preferred embodiment, acquiring database interaction messages, extracting semantic features representing the semantics of operations from the messages, and generating semantic fingerprints by combining the message source identifier includes: parsing the database interaction messages, constructing an abstract syntax tree, removing variable parameters from the abstract syntax tree, and extracting execution plan features reflecting the access structure and operation type; acquiring the source network identifier of the message as the message source identifier; and performing a hash operation on the execution plan features and the source network identifier to generate a semantic fingerprint.

[0025] Specifically, the database interaction message is obtained by capturing application-layer data units carrying database requests from the network session between the database client process and the database service process. The database interaction message refers to the complete protocol packet corresponding to a single request, whose payload contains a sequence of bytes of structured query statements or operation commands. Protocol parsing and lexical-syntactic analysis are performed on the database interaction message. After stripping the frame header and checksum according to the database communication protocol, the original statement text is extracted. A recursive descent parser scans the statement text, mapping keywords, identifiers, operators, and literals to different types of nodes according to the grammatical production rules, generating an abstract syntax tree (Abstract Syntax Tree). The Abstract Syntax Tree is a tree-like data representation method where the root node represents the statement type, internal nodes represent operations or connection structures, and leaf nodes represent syntactic components such as table names, column names, and constants. After constructing the Abstract Syntax Tree, all leaf nodes are traversed to identify variable parameters representing literal constant values. Variable parameters are defined as replaceable specific assignments in the operation semantics, including integers, floating-point numbers, strings, binary data, and date / time literals. Changes to these literals do not alter the access structure of the operation. The identified variable parameter nodes are removed from the abstract syntax tree (AST), and uniform placeholders are inserted in their original positions to strip away the variable parameters. Then, a depth-first normalized traversal is performed on the AST after inserting the placeholders to extract execution plan features. The execution plan features are a sequence of features arranged in a predetermined order. This sequence includes the operation type identifier, a list of involved pattern object names, the set of columns participating in conditional filtering, the comparison operator structure, and metadata references to the projection columns. It does not contain any specific values ​​of the variable parameters. The predetermined order is, for example, operation type, object name, condition columns, and projection columns. The execution plan features fully characterize the access structure and operation type semantics of the message after removing data value differences.

[0026] Synchronously extract the underlying network tuples from the database interaction messages to obtain the source network identifier as the message source identifier. The source network identifier can be a tuple consisting of the IPv4 source address and TCP source port carrying the message, or it can be extended to include the local process identifier in the same host scenario to uniquely distinguish connections initiated by different client processes under the same business logic. Serialize the execution plan features into a variable or fixed-length byte string, denoted as E, according to preset character concatenation and other encoding rules. Encode the source network identifier into a byte string, denoted as S, according to network byte order. Select a cryptographic hash algorithm as the hash operation operator, such as the compression function defined by the secure hash algorithm SHA-256. Perform a hash operation on the concatenation result of E and S to generate a semantic fingerprint. The hash operation process is expressed by the formula:

[0027] in, Represents the SHA-256 hash function, symbol This represents a byte string concatenation operation, where F is the calculated 256-bit hash value (i.e., the original 32-byte byte sequence). The semantic fingerprint is the hexadecimal lowercase string representation of F. This hash operation ensures that even small differences between the execution plan feature E and the source network identifier S can cause unpredictable avalanche changes in F. Dimensionally, all operations are performed on the byte string, and the output is a fixed-length bit string with no dimension collisions.

[0028] For example, in an environment monitoring MySQL database port 3306, the network packet capture layer intercepts an interactive message with the SQL statement "SELECT prod_id,sales_qty FROM orders WHERE region=3 AND period='2026-01'". After parsing, an abstract syntax tree is constructed, identifying the variable parameters "3" and '2026-01'. After stripping these parameters, they are replaced with placeholders "?". The extracted execution plan feature E is encoded as the feature sequence "SELECT:orders:prod_id,sales_qty:region,period:EQ,AND". Simultaneously, the source network identifier S, "10.20.30.40:51236", is extracted from the TCP header. After concatenating E and S and inputting SHA-256, the semantic fingerprint F is obtained as "b3f04e8a…" (hexadecimal prefix with subsequent bits omitted). This closed instance directly verifies the effectiveness of the execution plan features after stripping variable parameters, and the feasibility of generating semantic fingerprints by hashing the source network identifier.

[0029] S2. Based on semantic fingerprints, the messages are grouped by affinity, and consecutive operations with the same semantic fingerprints are aggregated into weighted macro nodes within a dynamically adjusted merging time window, wherein the duration of the merging time window is controlled by the back pressure signal.

[0030] In a preferred embodiment, consecutive operations with the same semantic fingerprint are aggregated into a weighted macro node within a dynamically adjusted merging time window. This includes: using the semantic fingerprint as a routing key to distribute packets with the same semantic fingerprint to the same memory processing thread, achieving affinity grouping; receiving a backpressure signal from the lockless circular buffer, the backpressure signal representing the current level of the lockless circular buffer; calculating an adjustment coefficient for the merging time window based on the backpressure signal, the adjustment coefficient increasing with the backpressure intensity; updating the duration of the merging time window based on the adjustment coefficient; merging multiple operation records that fall within the updated merging time window and have the same semantic fingerprint into a macro node, and accumulating their access frequency as the weight of the macro node during merging.

[0031] Specifically, after obtaining the semantic fingerprint F, the semantic fingerprint is used as the routing key to perform targeted packet distribution. The first 4 bytes of F are interpreted as an unsigned integer, and the target thread index is obtained by taking the modulo of the total number of pre-created memory processing threads T. A memory processing thread is an execution unit bound to an independent task queue and scheduled on a fixed CPU core. The target thread index is calculated as follows:

[0032] in, This indicates the integer value obtained by converting the first 4 bytes of F (when used as a 32-byte hash sequence) into big-endian order. `mod` represents the modulo operator, and `T` is the thread pool size. The thread number is determined. The current database interaction message is pushed into the [thread number]. The tail of the lock-free queue is dedicated to the memory processing thread. Therefore, packets with the same execution plan characteristics E and the same source network identifier S will inevitably generate completely identical semantic fingerprints F, and thus calculate the same... Messages with the same semantic fingerprint will be directed to the same memory processing thread. This mechanism of converging all messages with the same semantic fingerprint to a fixed processing thread constitutes affinity grouping. Affinity grouping eliminates contention for shared context resources among different threads, while naturally ensuring the sequential processing consistency of the same semantic sequence of operations for the same client.

[0033] After completing the physical-level thread affinity grouping described above, the memory processing thread further maintains a temporary mapping table with semantic fingerprints as keys and continuously consumes the database interaction message sequence allocated to it. For the currently processed message, the semantic fingerprint F generated in step S1 is extracted from the message metadata, and the temporary mapping table is checked to see if an intermediate operation record corresponding to F already exists. The temporary mapping table has a hash mapping data structure, where the key is the byte string representation of the semantic fingerprint, and the value is a list. The list elements are the operation records to be aggregated, and each operation record is associated with an arrival timestamp and a single operation count. To avoid memory leaks and data stagnation, a timeout cleanup timer is also configured internally. During this process, the memory processing thread periodically reads backpressure signals from the lock-free circular buffer.

[0034] The lock-free circular buffer is a circular memory region constructed in detail in step S3, used to temporarily store trajectory edges derived from macro nodes. The backpressure signal is generated by the lock-free circular buffer based on its own occupancy status and fed back to the aggregation step, characterizing the current level of the lock-free circular buffer. Specifically, the current level is defined as the ratio of the number of data units written to the lock-free circular buffer but not yet read and released by consumers to the total capacity of the buffer, denoted as the fill rate p. This value is expressed as a floating-point number, taking a closed interval between 0.0 and 1.0. Receiving the backpressure signal means atomically reading the fill rate p from the shared control block of the lock-free circular buffer. The read operation uses memory ordering to ensure visibility. The read pointer and write pointer of the lock-free circular buffer avoid false sharing due to cache line filling, ensuring the real-time nature of the p read value.

[0035] After receiving the backpressure signal, the adjustment coefficient of the merging time window is calculated based on the backpressure signal. The merging time window is a time threshold that determines the aggregation range of continuous operations, segmenting operations with the same semantic fingerprint according to their chronological order. The adjustment coefficient is denoted as... Its calculation employs a piecewise linear mapping, designed to expand the merging window as back pressure intensifies, thereby alleviating downstream pressure. The specific mapping relationship is defined as follows: a low water level threshold is set. The threshold value is 0.3, representing a high water level. It is 0.8. The counter-pressure strength is the fill rate. Size, adjustment coefficient Follow It increases with the increase of [something]. When [something] increases. Less than or equal to hour, Keep the baseline value at 1.0; when Greater than or equal to hour, Take the upper limit value , Set to 3.0; when Between and In between, Determined through linear interpolation. Adjustment coefficient. The calculation formula is as follows:

[0036] in, The fill rate is dimensionless. , The threshold parameter is set based on the actual measured throughput inflection point of the system under 150 different load pressures to ensure that the linear region covers the common jitter range. The upper limit of the adjustment coefficient is set to 3.0 based on the ratio of the average processing latency of memory processing threads to the maximum allowable waiting latency. All values ​​are 1, so there is no dimension conflict.

[0037] The duration of the merged time window is updated based on the adjustment coefficient. The base duration of the merged time window is denoted as... The base time length is set with reference to the typical session gap of database interaction messages. In this embodiment, the 95th percentile analysis of the arrival time interval of 400 sets of production environment database operations is used as the benchmark. The updated merged time window duration is 200 milliseconds. The calculation formula is:

[0038] in, The updated time duration, in milliseconds; The base time is a constant of 200 milliseconds; As the adjustment coefficient, it is dimensionless, therefore the dimension of the product remains milliseconds, maintaining dimensional consistency. For example, when... hour, , Milliseconds, the time window is lengthened to accommodate more operations for aggregation.

[0039] After updating the merge time window, the aggregation logic within the thread uses the arrival timestamp of the earliest record to be aggregated corresponding to the semantic fingerprint F in the temporary mapping table as the starting reference point, and then defines a length of [missing information]. The positive time window. When the timestamp of a newly arrived message exceeds the upper boundary of this time window (i.e., the earliest timestamp + ... When an operation is triggered, an aggregation operation is performed, merging multiple operation records whose arrival timestamps fall within the updated merge time window to generate a macro node. Simultaneously, to prevent operation records from remaining in the mapping table for extended periods in low-frequency access scenarios, a timeout cleanup timer performs periodic scans, cleaning up records that have remained in the table for longer than a specified time. Records not triggered by new messages will undergo forced aggregation output. Macro nodes are aggregated data structures used to abstract multiple identical semantic operations. They internally contain semantic fingerprints, operation types, operation subject identifiers, aggregation time spans, operation counts participating in the merge, and a unique identifier for the merged macro node. During merging, the access frequency of these operation records is accumulated, and the accumulated value is assigned to the weight attribute of the macro node. The weight is denoted as [weight attribute name missing]. Weight The calculation method is as follows:

[0040] Where N is the number of points that fall into the... The number of operation records with the same semantic fingerprint within the database. The access frequency of the i-th operation record is usually... Setting it to 1 indicates a single operation; if some aggregated records already exist, then... It can be greater than 1. The integer is greater than or equal to 1, and its unit is the number of operations. Simultaneously, these aggregated operation records are removed from the temporary mapping table to prevent them from being captured repeatedly by subsequent windows. If the arrival time of a new message exceeds... If the previously aggregated and generated macro nodes are solidified, newly arriving messages will participate in the next round of aggregation as the starting element of a new window.

[0041] Thus, consecutive operations with the same semantic fingerprint are aggregated into weighted macronodes within a dynamically adjusted merging time window. These macronodes are then used to construct trajectory edges and pushed into a lock-free circular buffer, thereby forming a feedback loop between the macronode generation rate and the consumption rate of downstream trajectory edge chain assembly through a backpressure signal. The entire process ensures that when the buffer is near saturation, the merging granularity becomes coarser and the macronode generation rate decreases to prevent buffer overflow; when the buffer is idle, the merging granularity becomes finer and macronodes are generated promptly, maintaining low latency.

[0042] For example, continuing the example environment from step S1, the generated semantic fingerprint F is used as the routing key. At this time, the total number of memory processing threads T in the system is configured to be 4. The first 4 bytes of F are converted to an integer and modulo 4 to obtain... The message is assigned to memory processing thread number 1. Subsequently, the same client connection sends another message "SELECT prod_id,sales_qty FROM orders WHERE region=5 AND period='2026-02'", which yields a completely identical execution plan feature E and source network identifier S. The semantic fingerprint F is again "b3f04e8a…". The routing key value calculation falls within the same thread 1. Thus, the subsequent processing of this series of operations is completed sequentially within the same thread, achieving affinity grouping.

[0043] Within memory processing thread 1, three database interaction messages were received sequentially from the source network identifier "10.20.30.40:51236" with a semantic fingerprint F of "b3f04e8a…", with timestamps of t1=1000 milliseconds, t2=1100 milliseconds, and t3=1300 milliseconds (relative time). The initial backvoltage signal fill rate p was 0.25, lower than… adjustment coefficient , Milliseconds. Starting from the earliest arriving timestamp t1, a 200-millisecond forward window is defined, covering the time range [1000 milliseconds, 1200 milliseconds]. When t2 arrives, it falls within this window and is temporarily stored together with t1. When message t3 arrives (1300 milliseconds), because it exceeds the current window boundary, an aggregation action is triggered, merging records t1 and t2 that fell into the window into a macro node M1, with the weight W accumulated to 2; t3 is then temporarily stored as the starting element of a new window. At this time, the backpressure signal rises to p=0.7 due to slow downstream consumption, and the adjustment coefficient α is recalculated. , , , Milliseconds. If a message arrives after t4 = 1400 milliseconds, the new window interval is [1300 milliseconds, 1820 milliseconds], with t4 falling within it, and it is temporarily stored together with t3. If no new messages arrive subsequently, the timeout cleanup timer will forcibly merge t3 and t4 into macro node M2 ​​after the time advances to 1820 milliseconds, with a weight W = 2. This process effectively solves the data retention problem and verifies the complete mechanism of dynamically adjusting the merging time window according to the backpressure signal and aggregating consecutive operations with the same semantic fingerprint into weighted macro nodes.

[0044] S3. Push the trajectory edges associated with the macro nodes into the lock-free circular buffer, assemble them into a trajectory edge chain in the lock-free circular buffer, and generate a back pressure signal based on the lock-free circular buffer's own occupancy status, which is then fed back to the aggregation step.

[0045] In a preferred embodiment, the trajectory edges associated with the macro node are pushed into the lock-free circular buffer, and a trajectory edge chain is assembled in the lock-free circular buffer. This includes: filling the data structures containing the read pointer and write pointer of the lock-free circular buffer with cache lines in the memory area occupied by the lock-free circular buffer, so that the read pointer and write pointer are located in different CPU cache lines; constructing the operation subject identifier, object identifier, operation type, and macro node reference involved in the macro node as trajectory edges; writing the trajectory edges sequentially into the lock-free circular buffer, using the read pointer, write pointer, and status flag bits to complete lock-free synchronization, and accumulating them in the buffer to form a trajectory edge chain.

[0046] Specifically, in step S2, the macro nodes generated by the dynamically adjusted merging time window carry weight attributes and operation context information. Step S3 is responsible for converting the macro nodes into trajectory edges and delivering them to the downstream lock-free circular buffer. Simultaneously, the lock-free circular buffer feeds back pressure signals to the aggregation step based on its own occupancy status. The lock-free circular buffer is a pre-allocated circular queue in a contiguous memory region. Multiple producer threads and a single consumer thread coordinate through atomic read and write pointers to achieve lock-free concurrent access. The producer threads are the memory processing threads that execute the affinity grouping and aggregation logic mentioned above. After completing the macro node aggregation in S2, these threads are responsible for constructing and writing trajectory edges. The consumer thread extracts trajectory edges from the buffer and assembles them into a trajectory edge chain for subsequent steps.

[0047] Within the memory area occupied by the lock-free circular buffer, the metadata structure managing the read and write pointers needs to be cache-line filled. Cache-line filling refers to forcibly adjusting the memory layout of the structure through compiler instructions or padding byte arrays, so that the read and write pointers reside in different CPU cache lines. The CPU's cache coherence protocol synchronizes data on a cache line basis, with a typical cache line size of 64 bytes. If the read and write pointers fall into the same cache line, when the producer thread updates the write pointer, the cache line will be set to a modified state, causing the same cache line in the processor core where the consumer thread resides to become invalid. Any access to the read pointer by the consumer will trigger a cache miss. This performance degradation caused by different threads modifying unrelated data in the same cache line is called false sharing. To avoid false sharing, when defining the control block structure, 64-byte padding character arrays are inserted before and after the write pointer field to ensure that the write pointer occupies a complete cache line; similarly, 64-byte padding character arrays are also inserted before and after the read pointer field to ensure that the read pointer occupies another complete cache line. Both the read pointer and write pointer are declared as atomic unsigned integer types, with a width consistent with the processor's address bus width, typically 64 bits. Let the starting address of the structure instance containing the write pointer be... After padding, the offset of the write pointer field is 64 bytes. Therefore, the actual memory address range where the write pointer resides is isolated within its own dedicated 64-byte cache line. For example, a 128-byte protective interval is formed by padding 64 bytes before and after the pointer. The starting address of the structure instance where the read pointer is located is After similar padding, the read pointer also occupies another complete cache line exclusively. The two sets of intervals do not overlap, so the two pointers reside in different CPU cache lines. Thus, the hardware cache operations of the producer thread updating the write pointer and the consumer thread reading the read pointer are isolated from each other, eliminating the interference of false sharing.

[0048] After a macro node is generated, a trajectory edge is constructed. A trajectory edge is a record unit that abstracts a single data flow behavior of a macro node into a directed relation. The operation subject identifier, object identifier, operation type, and a reference to the macro node itself are extracted from the macro node data structure. The operation subject identifier is the unique identifier of the client process initiating the database access, consisting of the operating system process identifier synchronously recorded in step S1 when extracting the source network identifier. The object identifier is the global name of the schema object hit by the database operation, including a combined string of the database name, schema name, and table name. The operation type is the access verb decoded from the execution plan characteristics, such as query, insert, update, or delete. The reference to the macro node itself is the starting address of the macro node in memory or an integer handle allocated via the unique identifier generator. These four pieces of information are serialized into a fixed-length message body with a fixed layout, and a redundant field for verification is appended, forming the trajectory edge.

[0049] After the trajectory edges are constructed, they are written sequentially to a lock-free circular buffer. The lock-free circular buffer consists of an array of elements, each slot holding the complete serialized data of one trajectory edge, along with an atomic state flag. The total capacity C is set to a power of 2, for example, 65536 slots, to facilitate fast modulo operation using bitmasks. Write pointer The producer thread proceeds atomically via atomic comparison and exchange instructions. Before each write operation, the producer loads the current write pointer value and the current read pointer value. A snapshot is taken to determine if the buffer is full, i.e., when... equal When there are no free slots, the producer needs to spin-wait or adopt a backoff strategy. When there are free slots, the producer attempts to allocate shared slots using a CAS command. Updated to If the CAS (Confirmation and Acceptance) is successful, then the producer has successfully pre-owned the original... The corresponding slot index; if CAS fails, it means that other concurrent producers have preempted the slot, and it needs to be tried again in a loop. After successful preemption, the producer copies the trajectory edge data to the buffer array with the original index. The location of the slot is determined, and then an atomic storage operation is used to update the status flag of that slot to "ready," along with a memory release order to ensure that the trace edge content is visible to the consumer. The consumer thread then loads the read pointer. ,examine Whether the status flag of the corresponding slot is "ready" is determined by checking if it is not empty and is ready. The position is read from the trajectory edge, processed, and then the slot state is reset to "idle" using atomic storage. Updated to The process involves consuming memory in sequence. Macro nodes are continuously pushed into the buffer, and different trajectory edges accumulate in the buffer according to the writing order. Consumer threads retrieve them sequentially from the read pointer, and these edges are linked together outside the buffer in the form of a linked list, which forms the trajectory edge chain.

[0050] During this process, the lockless circular buffer needs to generate a backpressure signal based on its own occupancy status and feed it back to the aggregation step. Its occupancy status is quantified by the fill rate p, which is calculated each time a producer successfully pre-occupies a slot or a consumer completes a read, to reflect the instantaneous water level. Let the current atomic read pointer value be... The current atomic write pointer value is ,and and All have been The processed valid index value, the actual number of slots occupied by the buffer. Calculated by the following formula:

[0051] in, `C` is a non-negative integer, dimensionless; `C` is the total capacity of the buffer, and the modulo operation guarantees that the result falls within the specified range. Within the range. The fill rate p is defined as:

[0052] p has a dimension of 1 and a range of values ​​of 1. The calculated p value is written to a shared memory location protected by atomic variables. This location is periodically read by each memory processing thread in step S2 as a backpressure signal. This backpressure signal represents the current level of the lock-free circular buffer and is correlated with the adjustment coefficient in step S2. Directly linked, forming a closed-loop feedback. Whenever As p approaches C, it approaches 1, indicating a large counter-pressure intensity. When p approaches 0, it indicates that the back pressure is small. Based on this signal, step S2 dynamically adjusts the length of the merging time window to match the macro node generation rate with the trajectory edge consumption rate, maintaining the balance of the overall process.

[0053] For example, continuing the scenario of macro node M1 generated in step S2, M1 has a weight W of 2, an operation subject identifier (the client process PID mapped by the number "10452"), an object identifier (the "orders" table), an operation type of "SELECT", and a reference to the macro node itself at memory address 0x7F3C00A1B000. These four pieces of information are packaged to construct a trajectory edge E1, with a size of 64 bytes. The total capacity C of the lock-free circular buffer is set to 4096, and the current read pointer... Write pointer to 1024. The value is 2048, calculated using the formula. Fill rate The memory processing thread reads this p value as a backpressure signal and sends it to step S2. Because the p value is low, step S2 adjusts the coefficient. Maintaining at 1.0, the merge time window remains at 200 milliseconds. Subsequently, the producer will successfully pre-book slot 2048 via a CAS instruction, at which point the shared write pointer... The value is atomically updated to 2049, used becomes 1025, p increases to approximately 0.2502, and the backvoltage signal is updated accordingly. The producer writes E1 to slot 2048 and marks it as ready. After the downstream consumer thread reads E1, it reads the pointer... Updated to 1025. The value was reduced back to 1024, and p dropped back to 0.25. This closed-loop process was completed entirely under lock-free synchronization conditions, avoiding performance jitter caused by false sharing, and using the instantaneous fill rate to drive the adaptive adjustment of the aggregation window.

[0054] S4. Monitor the weight attributes of macro nodes and the data output stream pointed to by the trajectory edge chain. When the cumulative weight of the macro node exceeds the preset risk weight benchmark, and the object resource type pointed to by the data output stream belongs to the external medium type set, and the data output stream is an external write operation, perform information entropy calculation on the data block to be output corresponding to the macro node to obtain the entropy value evaluation result.

[0055] In a preferred embodiment, when the cumulative weight of a macro node exceeds a preset risk weight benchmark, and the object resource type pointed to by the data output stream belongs to the external medium type set, and the data output stream is an external write operation, information entropy calculation is performed on the data block to be output corresponding to the macro node, including: obtaining the risk weight benchmark and the external medium type set determined based on the asset security level; extracting the cumulative weight of the macro node from the trajectory side chain and identifying the object resource type pointed to by the trajectory side chain; when the cumulative weight exceeds the preset risk weight benchmark and the object resource type belongs to the external medium type set, determining that the triggering condition is met; intercepting the data block to be output corresponding to the macro node in the current output stream, performing Shannon information entropy calculation on the data block to be output, and obtaining the entropy value evaluation result.

[0056] In a further preferred embodiment, before determining that the triggering condition is met, the method further includes: obtaining field tag information corresponding to the database access request associated with the macro node; matching the field tag information with a pre-configured set of sensitive data fields; if the match is successful, confirming the execution of subsequent triggering condition judgment for the macro node; otherwise, skipping the information entropy calculation.

[0057] Specifically, in step S3, the consumer thread continuously retrieves trajectory edges from the lock-free circular buffer and links them sequentially in memory to form a trajectory edge chain. Each node in the trajectory edge chain corresponds to a weighted macro node, and the traversal direction of the linked list is consistent with the chronological order of the database operations. Simultaneously, the monitoring logic in step S4 is mounted to the file system and socket write path at the operating system kernel level, capturing output operations triggered by the database client processes associated with these macro nodes. By extracting the process context identifier (PID) of the currently executing write operation at the kernel level and comparing it in real time with the operation subject identifier recorded in each node of the trajectory edge chain, once a matching database client process is found to be writing data to an external device, a series of conditional judgments are initiated to determine whether to perform an information entropy evaluation on the output data.

[0058] First, obtain the risk weighting benchmark and the set of external media types determined based on the asset security level. The risk weighting benchmark is an integer threshold, denoted as... The asset security level is set based on the asset security classification of database tables or schema objects. The asset security level is a scalar level configured by the security administrator for each table during system initialization according to data classification and grading specifications, divided into four levels: Public, Internal, Sensitive, and Confidential, mapped to numerical labels 1, 2, 3, and 4 respectively. Based on statistics of normal access frequency and data leakage cases in a test environment containing 200 actual business databases, when the asset level is Sensitive or higher, the aggregate weight of more than 50 identical semantic operations within a short period is strongly correlated with data leakage behavior. Therefore, the risk weight benchmark corresponding to the Sensitive level is... The threshold is set to 50 for the confidential level and 30 for the internal and public levels. Generally, information entropy calculations are not required for these levels, and their thresholds can be set to maximum values. (External media type set) It is a predefined set of media type identifiers that characterize the flow of data to the outside of the system, including the strings "FILE" for ordinary disk files, "SOCKET" for network sockets, and "PIPE" for named pipes. These media types can be obtained from file descriptor or handle attributes when intercepting write operations.

[0059] Next, the cumulative weight of the current macro node is extracted from the trajectory edge chain, and the type of object resource pointed to by the trajectory edge chain is identified. The cumulative weight is the access frequency W accumulated for the macro node in step S2. This value is stored in the weight attribute field of the macro node data structure and can be read directly. The process of identifying the object resource type is as follows: when the database client process corresponding to the macro node executes a write system call, the target file descriptor is parsed from the parameters of the system call, and then the file system driver interface is called to query the type of the node corresponding to the descriptor. If the target node is a regular file in the disk file system, the object resource type is "FILE"; if it is a socket, "SOCKET" is returned; if it is a pipe, "PIPE" is returned. This type string is the type of object resource pointed to by the trajectory edge chain, because the write operation is triggered by the macro node data stream represented by the trajectory edge chain.

[0060] Before formally determining whether the triggering conditions are met, sensitive fields need to be pre-screened. The field tag information corresponding to the database access request associated with the macro node is obtained. This field tag information originates from the projected column metadata extracted during the parsing of the database interaction message in step S1. After constructing the abstract syntax tree in step S1, the column names or result set column labels involved in the query statement are recorded synchronously when extracting execution plan features. These column identifiers are cached in a string array within the macro node data structure. Using the macro node reference carried in the trajectory edge, the cached projected column string array in the macro node data structure is read back, serving as the field tag information to be matched. Each column name in the field tag information is matched one by one against a pre-configured set of sensitive data fields. The set of sensitive data fields is defined by the security administrator during the initial system configuration and includes field name patterns such as "id_card", "bank_account", "phone", "password_hash", and "sales_qty," stored as a case-insensitive regular expression matching rule base or a trie data structure. The matching is based on the strings being completely equal or satisfying wildcard rules. If at least one column matches the set of sensitive data fields, the match is successful, and subsequent trigger condition judgments are performed on the macro node. If none of the column names match, the match fails, the information entropy calculation is skipped, the external write operation is not interfered with, and the data block is output normally.

[0061] Assuming a successful match in the sensitive fields, the process proceeds to the precise trigger condition determination stage. This occurs when the cumulative weight W extracted from the trajectory sidechain exceeds the risk weight benchmark. Furthermore, the object resource type obtained from the current write operation belongs to the external media type set. When the triggering condition is met, it is determined that the condition is met. This joint condition ensures that entropy calculation is performed only when high-frequency sensitive data is projected onto an external medium, balancing system computational resource consumption and detection accuracy.

[0062] Once the trigger condition is met, the corresponding data block to be output in the current output stream for that macro node is immediately intercepted. The interception method involves suspending the user-mode data block originally to be copied to the kernel buffer in the file system or socket driver layer's write path, and copying it to the monitoring process's temporary buffer without interrupting the original write process (using copy-on-write technology to ensure the atomicity of the operation), thus obtaining a complete copy of the data block to be output. This data block to be output is a byte sequence with a length of L bytes (to ensure statistical significance, L ≥ 512 bytes is usually required). Shannon entropy calculation is performed on this data block to obtain the entropy evaluation result H. The formula for calculating Shannon entropy is:

[0063] Where j represents the index of the possible values ​​of the byte, ranging from 0 to 255, a total of 256 possibilities; The frequency of byte value j in the entire block of data to be output is... , This represents the number of times the byte value j appears in the data block. If a certain j does not appear, then it is stipulated that... .because The probability value is dimensionless, logarithm The base 2 gives it the dimension of bits, therefore The unit is bit, and H is measured in bits per byte, describing the average amount of information carried by each byte. This calculation is performed by traversing 256 statistical buckets through the data block, ultimately outputting a floating-point number H between 0 and 8 as the entropy evaluation result.

[0064] Thus, step S4 completes the monitoring of macro node weight attributes and data output stream, and calculates the entropy value of the data block to be output in sensitive and high-frequency situations, providing a basis for subsequent determination of whether encryption leakage has occurred.

[0065] For example, in the trajectory edge chain assembled in step S3, a macro node is generated as high-frequency queries continue. The weight W is 55, the operation subject is identified as process PID 10452, the object is the "orders" table, and the operation type is "SELECT". The monitoring module captured that PID 10452 opened a regular file with a file descriptor pointing to the path " / tmp / export.csv", and the object resource type is "FILE". (Risk weight benchmark in system configuration) The "orders" table (classified as sensitive) is set to 50, representing the set of external media types. The data contains "FILE". Furthermore, backtracking through macro nodes reveals field marker information including column names "prod_id" and "sales_qty", which happens to be present in the sensitive data field set. The sensitive field match is successful, with a cumulative weight of 55 exceeding 50, and the object resource type "FILE" belongs to... The trigger condition is met. The intercepted data block to be output is a 4096-byte CSV text file, and its Shannon entropy is calculated. After counting the frequency of each byte, if the data is plaintext numeric text, the byte distribution is concentrated among numbers and commas, with an entropy value H of approximately 3.2 bits per byte; if the data has been AES encrypted, the byte distribution is nearly uniform, with H of approximately 7.98 bits per byte. This entropy value evaluation result H is passed to step S5 to determine whether it is high-entropy encrypted data.

[0066] S5. When the entropy evaluation result indicates an encrypted stream and the process performing the external write operation has a derivation relationship with the process accessing the macro node, add an entropy transformation edge from the macro node to the corresponding high-entropy data block in the multidimensional trajectory graph, and generate a data leakage risk alarm based on the entropy transformation edge.

[0067] In a preferred embodiment, when the entropy evaluation result indicates an encrypted stream and the process performing the external write operation has a derivative relationship with the process accessing the macro node, an entropy transformation edge from the macro node to the corresponding high-entropy data block is added to the multidimensional trajectory graph. This includes: obtaining the theoretical upper limit of entropy based on byte distribution characteristics, and determining the entropy range for encryption determination based on the theoretical upper limit of entropy; comparing the entropy evaluation result with the entropy range, and if it falls within the entropy range, determining that the data block to be output is high-entropy encrypted data; extracting the database client process identifier recorded in the database access operation associated with the macro node, and obtaining the target process identifier performing the external write operation; constructing a process tree of the database client process identifier and the target process identifier, and determining that a derivative relationship exists when the target process is a child process of the database client process; and generating an entropy transformation edge connecting the macro node and the high-entropy encrypted data in the multidimensional trajectory graph to form a leaked path segment.

[0068] In a further preferred embodiment, after generating the entropy transformation edge, the method further includes: extracting the transport layer handle corresponding to the outgoing network connection from the high-entropy encrypted data block write event associated with the entropy transformation edge; and calling the network protocol stack driver interface to send a connection reset blocking command to the transport layer handle to prevent the encrypted data from being transmitted outward.

[0069] In a further preferred embodiment, generating a data leakage risk alarm based on the entropy transformation edge includes: extracting macro node information, high-entropy data block metadata, and target process identifier involved in the entropy transformation edge; constructing an alarm event entity containing macro node information, high-entropy data block metadata, and process information; and sending the alarm event entity to the security operations center via the system log protocol or simple network management protocol to trigger a physical-level alarm.

[0070] Specifically, after intercepting and completing the Shannon information entropy calculation in step S4, an entropy evaluation result H in floating-point form is output, which carries the degree of randomness of the data block to be output. Simultaneously, the monitoring component in step S4 has recorded the target process identifier performing the external write operation, as well as the database client process identifier contained within the macro node that triggered the write. Step S5, based on the correlation between these two identifiers and combined with the entropy value determination, constructs an entropy transformation edge in the multi-dimensional trajectory graph, pointing from the macro node to the corresponding high-entropy encrypted data block, and includes subsequent blocking and alarm actions.

[0071] The system determines the upper limit of theoretical entropy based on information theory principles. The upper limit of theoretical entropy is defined as the maximum amount of information contained per byte on average when byte values ​​are completely random and follow a uniform distribution of 256 possible values. Its value is constant at 8 bits per byte, denoted as [missing value]. Bits / byte. To determine whether the data block to be output is an encrypted stream, H needs to be compared with the entropy range for encryption determination, which is determined based on the theoretical upper limit of entropy. The entropy range for encryption determination is a continuous interval. ,in This is the lower threshold for encryption detection. This lower threshold was determined through statistical analysis of 256 AES ciphertext samples with different key lengths and operating modes, and 128 ChaCha20 ciphertext samples. The average Shannon entropy of these samples is approximately 7.98, and the minimum is approximately 7.62. Considering that some encryption payloads may contain low-entropy structures such as fixed headers and checksums, to maintain detection sensitivity and avoid introducing excessive false negatives, this lower threshold is set... Set to 7.0. Therefore, the entropy range for encryption determination is defined as follows: Compare the entropy value evaluation result H obtained in step S4 with the entropy value interval. If H falls within the interval, then the following condition is met:

[0072] The data block to be output is then determined to be high-entropy encrypted data. High-entropy encrypted data means that the data block statistically exhibits byte distribution characteristics consistent with the encrypted payload, and is very likely to carry the encrypted original database content.

[0073] Simultaneously with the encrypted stream determination, process derivation relationship verification begins. The database client process identifier recorded in the database access operations associated with the macro node is extracted. This identifier is the operation subject identifier written during the construction of the trajectory edge in step S3, and is the client process PID obtained through the operating system interface when the database interaction message is first parsed, denoted as... Obtain the target process identifier for the external write operation. This identifier is the PID of the process that sent the write request, which is directly read from the kernel process control block within the write system call context intercepted in step S4. It is denoted as... Build and A process tree is a directed tree structure that reflects the parent-child relationship between processes. It is obtained by traversing the process parent-child relationship table maintained by the operating system. Each process node records the parent process identifier, and the nodes are linked downwards from the root process. As the root node, recursively search all descendants along the child process linked list. Appeared In any level of child processes, including direct child processes and deeper descendant processes generated through multiple forks, it is determined that... The process is a child process of the database client process, thus establishing a forgery relationship. This check can prevent attempts to bypass direct process association detection by methods such as "first connecting to the database, then forging an upload process to encrypt and transmit the data."

[0074] When both conditions are met—that the entropy evaluation result indicates an encrypted stream and that a derivation relationship exists—an entropy transformation edge is added to the multidimensional trajectory graph, pointing from a macro node to the corresponding high-entropy encrypted data. The multidimensional trajectory graph is a directed attribute graph residing in memory. Its node types include macro nodes and data block nodes, and its edge types include existing data stream edges in the trajectory edge chain and newly introduced entropy transformation edges. In this step, the graph engine first creates a new data block node for the intercepted high-entropy encrypted data, recording the data block's metadata, such as size L, entropy value H, storage path or network target address, and creation timestamp. Then, starting from the macro node and ending at the high-entropy encrypted data node, a directed edge is created, labeled "ENTROPY_TRANSFORM," and the edge is appended with the following attributes: derivation verification result and target process identifier. Transition time. This directed edge is defined as an entropy change transition edge, which fully describes the state transition from a high-frequency sensitive database query to the outflow of encrypted data, forming a leakage path segment.

[0075] After generating entropy transformation edges in the multidimensional trajectory graph, an active blocking mechanism is immediately triggered. The transport layer handle corresponding to the outgoing network connection is extracted from the high-entropy encrypted data block write event associated with the entropy transformation edge. A transport layer handle is a pointer to a control structure or an integer value of a file descriptor representing an active network connection (e.g., a TCP connection) in the kernel. In step S4, when intercepting a write operation, if the object resource type is "SOCKET", the file descriptor corresponding to the socket is saved synchronously, and this file descriptor is converted into a transport layer handle. The network protocol stack driver interface is called to issue a connection reset blocking instruction to this transport layer handle. In a system environment that follows a portable operating system interface, getsockopt can be called to query and convert the socket pointer to a raw socket pointer. Then, the connection termination function inside the kernel network protocol stack is called to directly inject a reset flag into the TCP control block associated with the socket, forcibly terminating the outgoing connection and preventing the encrypted data from being transmitted further. This process cuts off the data leakage path without damaging the client process.

[0076] After the blocking action is completed, a data leakage risk alert is generated based on the entropy transformation edge. Macro node information involved in the entropy transformation edge is extracted, including semantic fingerprint, operation type, object identifier, and cumulative weight; metadata of high-entropy data blocks is extracted, including data block length L, entropy value H, outgoing path or target IP and port; and the target process identifier is extracted. The alarm event entity is constructed, containing the macro node information, high-entropy data block metadata, and process information, along with its process image name. The alarm event entity is a key-value pair text or structured data conforming to the system log format, such as JSON serialization. It is sent via the system log protocol, either using User Datagram Protocol (UDP) to port 514 of the local or remote system log server in RFC 5424 format, or via Simple Network Management Protocol (SMMP) in Trap message format to the Security Operations Center. Upon receiving the alarm event entity, the Security Operations Center parses and converts it into a visual alarm ticket, triggering a physical-level alarm and notifying security analysts to initiate an emergency response.

[0077] For example, based on the macro nodes in step S4 In the given scenario, the database client process with PID 10452 executed a cumulative 55 queries on the "orders" table, matching the sensitive field "sales_qty," thus triggering the condition. Assuming continuous system monitoring reveals that a derived process of this client subsequently attempted to send encrypted data via a network socket, the S4 module intercepted a 4096-byte block of data to be output. The calculated entropy evaluation result H was 7.98 bits / byte, falling within the range [7.0, 8.0], indicating that the data block to be output was high-entropy encrypted data. Further investigation revealed that the process performing the external write operation had PID 11530, mapped to "curl." Process tree analysis showed its parent process PID was 10453, and PID 10453's parent process was PID 10452. Constructing the process tree confirmed that PID 11530 was a grandchild process of PID 10452, establishing the derivation relationship. A high-entropy encrypted data node was then created in the multidimensional trajectory graph. Its metadata includes a size of 4096 bytes, an entropy of 7.98, a target path of the TCP connection "198.51.100.15:443", and a newly added entropy transformation edge E_entropy, starting from... The destination is This creates a leaked path segment. The transport layer handle of the TCP connection, file descriptor 24, is extracted. A connection reset blocking command is issued via setsockopt combined with SO_LINGER and close operations, or by calling the kernel tcp_reset function, interrupting the connection. Simultaneously, an alarm event entity is assembled, containing the semantic fingerprint "b3f04e8a…", operation type "SELECT", object "orders", weight 55, data block size 4096, entropy value 7.98, target IP "198.51.100.15" and port 443, and target process 11530 / curl. This entity is sent to the security operations center via UDP port 514 to complete the alarm. This example demonstrates in a closed manner the complete process from entropy value determination, derivation relationship verification to entropy transformation edge construction, blocking, and alarming.

[0078] Please see Figure 2 As shown, the data leakage risk identification system based on multidimensional trajectory graphs provided by the second aspect of the present invention includes: a semantic fingerprint extraction module, an adaptive aggregation module, a trajectory edge chain assembly module, a directional entropy detection module, and a graph tracing alarm module.

[0079] The semantic fingerprint extraction module is used to obtain database interaction messages, extract semantic features representing the semantics of operations in the messages, and generate semantic fingerprints by combining the message source identifier.

[0080] The adaptive aggregation module is used to group messages based on semantic fingerprints according to affinity, and to aggregate consecutive operations with the same semantic fingerprint into weighted macro nodes within a dynamically adjusted merging time window, wherein the duration of the merging time window is controlled by the back pressure signal.

[0081] The trajectory edge chain assembly module is used to push the trajectory edges associated with macro nodes into the lockless circular buffer, assemble them into a trajectory edge chain in the lockless circular buffer, and generate a back pressure signal based on the lockless circular buffer's own occupancy status, which is then fed back to the aggregation step.

[0082] The directional entropy detection module is used to monitor the weight attributes of macro nodes and the data output stream pointed to by the trajectory edge chain. When the cumulative weight of the macro node exceeds the preset risk weight benchmark, and the object resource type pointed to by the data output stream belongs to the external medium type set, and the data output stream is an external write operation, the information entropy calculation is performed on the data block to be output corresponding to the macro node to obtain the entropy evaluation result.

[0083] The graph tracing alarm module is used to add an entropy transformation edge from the macro node to the corresponding high-entropy data block in the multidimensional trajectory graph when the entropy value evaluation result indicates an encrypted stream and the process performing the external write operation has a derivation relationship with the process accessing the macro node, and generate a data leakage risk alarm based on the entropy transformation edge.

[0084] Each of the modules can be implemented in whole or in part through software, hardware, or a combination thereof. It supports hardware embedded in or independent of the processor in the computer device, and also supports software stored in the memory of the computer device, so that the processor can call and execute the operations corresponding to each of the above modules.

[0085] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included within the protection scope of the present invention.

Claims

1. A data leakage risk identification method based on multidimensional trajectory mapping, characterized in that, include: S1. Obtain database interaction messages, extract semantic features representing the semantics of operations from the messages, and generate semantic fingerprints by combining the message source identifier; S2. Based on semantic fingerprints, the messages are grouped by affinity, and consecutive operations with the same semantic fingerprints are aggregated into weighted macro nodes within a dynamically adjusted merging time window, wherein the duration of the merging time window is controlled by the back pressure signal. S3. Push the trajectory edges associated with the macro nodes into the unlocked circular buffer, assemble them into a trajectory edge chain in the unlocked circular buffer, and generate a back pressure signal based on the unlocked circular buffer's own occupancy status to feed back to the aggregation step. S4. Monitor the weight attributes of macro nodes and the data output stream pointed to by the trajectory edge chain. When the cumulative weight of the macro node exceeds the preset risk weight benchmark, and the object resource type pointed to by the data output stream belongs to the external medium type set, and the data output stream is an external write operation, perform information entropy calculation on the data block to be output corresponding to the macro node to obtain the entropy value evaluation result. S5. When the entropy evaluation result indicates an encrypted stream and the process performing the external write operation has a derivation relationship with the process accessing the macro node, add an entropy transformation edge from the macro node to the corresponding high-entropy data block in the multidimensional trajectory graph, and generate a data leakage risk alarm based on the entropy transformation edge.

2. The data leakage risk identification method based on multidimensional trajectory mapping according to claim 1, characterized in that, Obtain database interaction messages, extract semantic features representing the semantics of operations from the messages, and generate semantic fingerprints by combining the message source identifier, including: The database interaction messages are parsed, an abstract syntax tree is constructed, the variable parameters in the abstract syntax tree are stripped, and the execution plan features that reflect the access structure and operation type are extracted. Obtain the source network identifier of the message as the message source identifier; A semantic fingerprint is generated by hashing the execution plan characteristics and the source network identifier.

3. The data leakage risk identification method based on multidimensional trajectory mapping according to claim 1, characterized in that, Consecutive operations with the same semantic fingerprint are aggregated into weighted macro nodes within a dynamically adjusted merging time window, including: By using semantic fingerprints as routing keys, packets with the same semantic fingerprint are directed to the same memory processing thread to achieve affinity grouping. Receive the back pressure signal fed back from the unlocked ring buffer, which represents the current water level of the unlocked ring buffer; The adjustment coefficient of the merging time window is calculated based on the back pressure signal. The adjustment coefficient increases with the increase of back pressure intensity. Update the duration of the merged time window based on the adjustment coefficient; Multiple operation records that fall within the updated merging time window and have the same semantic fingerprint are merged into a macro node, and their access frequency is accumulated as the weight of the macro node during merging.

4. The data leakage risk identification method based on multidimensional trajectory mapping according to claim 1, characterized in that, The trajectory edges associated with the macro nodes are pushed into the lock-free circular buffer, and a trajectory edge chain is assembled in the lock-free circular buffer, including: In the memory area occupied by the lock-free circular buffer, the data structures containing the read pointer and write pointer of the lock-free circular buffer are filled with cache lines so that the read pointer and write pointer are located in different CPU cache lines. Construct trajectory edges from the operation subject identifier, object identifier, operation type, and macro node references involved in the macro node; The trajectory edges are written sequentially into the lock-free circular buffer. Lock-free synchronization is achieved using read pointers, write pointers, and status flags, and the trajectory edge chain is accumulated in the buffer.

5. The data leakage risk identification method based on multidimensional trajectory mapping according to claim 1, characterized in that, When the cumulative weight of a macro node exceeds a preset risk weight benchmark, and the object resource type pointed to by the data output stream belongs to the external media type set, and the data output stream is an external write operation, information entropy calculation is performed on the data block to be output corresponding to the macro node, including: Obtain the risk weight benchmark and set of external media types determined based on asset security level; Extract the cumulative weights of macro nodes from the trajectory edge chains and identify the object resource types pointed to by the trajectory edge chains; When the cumulative weight exceeds the preset risk weight benchmark, and the object resource type belongs to the set of external media types, the triggering condition is determined to be met. Intercept the data block to be output corresponding to the macro node in the current output stream, perform Shannon information entropy calculation on the data block to be output, and obtain the entropy value evaluation result.

6. The data leakage risk identification method based on multidimensional trajectory mapping according to claim 5, characterized in that, Before determining whether the triggering condition is met, it also includes: Retrieve the field tagging information corresponding to the database access request associated with the macro node; Match the field tagging information with a pre-configured set of sensitive data fields; If a match is successful, the subsequent trigger condition judgment is performed on the macro node; otherwise, the information entropy calculation is skipped.

7. The data leakage risk identification method based on multidimensional trajectory mapping according to claim 1, characterized in that, When the entropy evaluation result indicates an encrypted stream and the process performing the external write operation has a derivation relationship with the process accessing the macro node, add an entropy transformation edge from the macro node to the corresponding high-entropy data block in the multidimensional trajectory graph, including: Obtain the upper limit of the theoretical entropy value based on the byte distribution characteristics, and determine the entropy value range for encryption determination based on the upper limit of the theoretical entropy value; The entropy value evaluation result is compared with the entropy value range. If it falls within the entropy value range, the data block to be output is determined to be high-entropy encrypted data. Extract the database client process identifier recorded in the database access operations associated with the macro node, and obtain the target process identifier for performing the external write operation. Construct a process tree of database client process identifiers and target process identifiers. When the target process is a child process of the database client process, it is determined that a derivation relationship exists. In the multidimensional trajectory graph, entropy transformation edges connecting macro nodes and high-entropy encrypted data are generated to form leakage path segments.

8. The data leakage risk identification method based on multidimensional trajectory mapping according to claim 7, characterized in that, After generating the entropy-change transition edge, the following is also included: Extract the transport layer handle corresponding to the outgoing network connection from the high-entropy encrypted data block write event associated with the entropy transformation edge; The network protocol stack driver interface is invoked to send a connection reset blocking command to the transport layer handle, preventing encrypted data from being transmitted.

9. The data leakage risk identification method based on multidimensional trajectory mapping according to claim 1, characterized in that, Data leakage risk alerts are generated based on entropy transformation edges, including: Extract macro node information, high-entropy data block metadata, and target process identifiers involved in entropy transformation edges; Construct an alarm event entity that includes macro node information, high-entropy data block metadata, and process information; The alarm event entity is sent to the security operations center via the system log protocol or simple network management protocol, triggering a physical-level alarm.

10. A data leakage risk identification system based on multidimensional trajectory mapping, characterized in that, include: The semantic fingerprint extraction module is used to obtain database interaction messages, extract semantic features that represent the semantics of operations in the messages, and generate semantic fingerprints by combining them with the message source identifier. An adaptive aggregation module is used to group packets based on semantic fingerprints according to affinity, and to aggregate consecutive operations with the same semantic fingerprint into weighted macro nodes within a dynamically adjusted merging time window, wherein the duration of the merging time window is controlled by a backpressure signal. The trajectory edge chain assembly module is used to push the trajectory edges associated with macro nodes into the lock-free circular buffer, assemble them into a trajectory edge chain in the lock-free circular buffer, and generate a back pressure signal based on the lock-free circular buffer's own occupancy status, which is then fed back to the aggregation step. The directional entropy detection module is used to monitor the weight attributes of macro nodes and the data output stream pointed to by the trajectory edge chain. When the cumulative weight of the macro node exceeds the preset risk weight benchmark, and the object resource type pointed to by the data output stream belongs to the external medium type set, and the data output stream is an external write operation, the information entropy calculation is performed on the data block to be output corresponding to the macro node to obtain the entropy evaluation result. The graph tracing alarm module is used to add an entropy transformation edge from the macro node to the corresponding high-entropy data block in the multidimensional trajectory graph when the entropy value evaluation result indicates an encrypted stream and the process performing the external write operation has a derivation relationship with the process accessing the macro node, and generate a data leakage risk alarm based on the entropy transformation edge.

Images