A database auditing method, apparatus, device and medium

Abstract

This invention discloses a database auditing method, apparatus, device, and medium, relating to the database field. After parsing the access traffic of a target database to obtain target packets, it first determines whether the target packets contain corresponding database login information. When the target packets do not contain corresponding database login information, the target database login information associated with the target packet can be obtained by searching for target database login information that matches the characteristics of a first packet from a preset correspondence. Based on this correspondence, an audit log entry corresponding to the target packet is generated. This invention enables effective auditing of the target database login information associated with the target packet even when the target packet does not contain database login information, by searching for a preset correspondence, thereby generating a complete and traceable audit log entry for the target packet, significantly improving the ability to extract SQL statements and the database login information associated with SQL packets.

Description

Technical Field

[0001] This invention relates to the field of databases, and in particular to a database auditing method, apparatus, device, and medium. Background Technology

[0002] To enhance the transparency and security of database systems and ensure their ability to identify and address potential risks and threats, databases employ auditing measures to determine the identity of the login account associated with each SQL (Structured Query Language) statement. This records the identity of the specific executor of the SQL statement, serving as evidence for post-access behavior auditing, tracing, and alerting. Current technologies determine the account identity information associated with SQL statements and messages by auditing the login packet corresponding to the database within the SQL message. However, in practice, some login accounts may have long timeouts, or even never time out. Since the audit start time is random, it may not be possible to capture the login packet corresponding to that account in a timely manner, preventing the database from auditing the account identity information associated with certain SQL statements or messages. Summary of the Invention

[0003] In view of this, the purpose of this invention is to provide a database auditing method, apparatus, device, and medium. The specific solution is as follows: Firstly, this application discloses a database auditing method, including: The access traffic to the target database is parsed to determine whether the target packets in the access traffic contain the corresponding database login information; If the target message does not contain the corresponding database login information, then the target database login information that matches the first message feature is searched from the preset correspondence relationship; the preset correspondence relationship is the correspondence between the database login information and message features pre-stored by the target database, and the first message feature is the message feature of the target message; The found target database login information is associated with the target message, and the corresponding association is recorded to generate an audit log entry corresponding to the target message.

[0004] Optionally, the target message carries a five-tuple and client information; the five-tuple includes the source IP, source port, protocol, destination IP, and destination port of the target message; The first message feature includes the session hash value corresponding to the target message. The session hash value is calculated by concatenating the five-tuple and the client information according to a preset format and then performing a secure hash algorithm.

[0005] Optionally, search for target database login information that matches the features of the first message from a preset correspondence, including: Find a second message feature from the preset correspondence that has a similarity greater than a preset threshold to the first message feature; The database login information corresponding to the second message feature is determined as the target database login information that matches the first message feature.

[0006] Optionally, the access traffic to the target database is parsed to determine whether the target packets in the access traffic contain corresponding database login information, including: Extract target packets from the access traffic to the target database; Determine the message type of the target message; The target message is parsed based on the parsing method corresponding to the message type to determine whether the target message contains the corresponding database login information.

[0007] Optional, also includes: If no target database login information matching the first message feature is found in the preset correspondence, then simulated login information of the target database is generated; The simulated login information is associated with the target message, and the corresponding association is recorded to generate an audit log entry corresponding to the target message.

[0008] Optional, also includes: The preset correspondence is updated based on the database login information associated with the target message and the first message feature of the target message; The database login information associated with the target message includes the target database login information found from a preset correspondence, the database login information contained in the target message, and the simulated login information.

[0009] Optional, also includes: If the target message contains corresponding database login information, and there is a third message feature in the preset correspondence that matches the first message feature, then it is determined whether the database login information corresponding to the third message feature is simulated login information. If the database login information corresponding to the third message feature is simulated login information, then the database login information corresponding to the third message feature in the preset correspondence is replaced with the database login information contained in the target message; Replace the simulated login information corresponding to the third message feature in the audit log of the target database with the database login information contained in the target message.

[0010] Secondly, this application discloses a database auditing device, comprising: The parsing unit is used to parse the access traffic to the target database to determine whether the target packets in the access traffic contain the corresponding database login information. The lookup unit is configured to search for target database login information that matches the first message feature from a preset correspondence if the target message does not contain the corresponding database login information; the preset correspondence is the correspondence between database login information and message features pre-stored by the target database, and the first message feature is the message feature of the target message; The association unit is used to associate the found target database login information with the target message and record the corresponding association relationship to generate the audit log entry corresponding to the target message.

[0011] Thirdly, this application discloses an electronic device including a processor and a memory; wherein the memory is used to store a computer program, which is loaded and executed by the processor to implement the database auditing method as described above.

[0012] Fourthly, this application discloses a computer-readable storage medium for storing a computer program, which, when executed by a processor, implements the database auditing method as described above.

[0013] This invention discloses a database auditing method, apparatus, device, and medium. After parsing the access traffic of a target database to obtain target packets, it first determines whether the target packets contain corresponding database login information. If the target packets do not contain corresponding database login information, the target database login information associated with the target packets can be obtained by searching for target database login information that matches the characteristics of a first packet from a preset correspondence. Based on this correspondence, an audit log entry corresponding to the target packets is generated. This method can effectively audit the target database login information associated with the target packets even when the target packets do not contain database login information, thereby generating complete and traceable audit log entries for the target packets. This significantly improves the ability to extract SQL statements and the database login information associated with SQL packets. Attached Figure Description

[0014] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0015] Figure 1 A flowchart illustrating a database auditing method provided by the present invention; Figure 2 A flowchart illustrating another database auditing method provided by the present invention; Figure 3 A schematic diagram of the structure of a database auditing device provided by the present invention; Figure 4 This is a schematic diagram of the structure of an electronic device provided by the present invention. Detailed Implementation

[0016] The core of this invention is to provide a database auditing method, apparatus, device, and medium that can effectively audit the target database login information associated with the target message by searching a preset correspondence even when the target message does not contain database login information. This generates a complete and traceable audit log entry for the target message, significantly improving the ability to extract SQL statements and database login information associated with SQL messages.

[0017] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] See Figure 1 As shown, Figure 1 A flowchart illustrating a database auditing method provided by the present invention; In a first aspect, this application discloses a database auditing method, comprising: S11: Parse the access traffic to the target database to determine whether the target packets in the access traffic contain the corresponding database login information; It's easy to understand that database auditing is performed to improve the transparency and security of database systems. Database auditing systematically records, analyzes, and continuously monitors all operational events within the database. By fully recording all access behaviors, it establishes a precise mapping between operations and subjects, thereby achieving traceability of data access. Therefore, database auditing requires identity association for database operations. This association starts with the message and ends with the corresponding database login information. For each received message, the associated database login information must be determined to generate a complete and traceable audit log.

[0019] Understandably, databases receive massive, continuous messages, forming access traffic. For any message within this access traffic, it needs to be used as a target message to determine the corresponding database login information. Furthermore, since some messages themselves contain their own database login information, the access traffic to the target database first needs to be parsed to determine if the target messages within the access traffic contain the corresponding database login information. If the target message contains the corresponding database login information, the database login information associated with the target message can be directly extracted. Subsequently, the audit log entry corresponding to the target message can be generated directly based on this association. This application does not specifically limit the specific parsing method for access traffic, nor does it specifically limit the specific identification method and implementation form of the database login information contained within the message itself. Specifically, the database login information contained within the message itself can be a login packet, which directly includes the database login information associated with the message. For different database types, the implementation of the corresponding database login information in the message will vary. Generally, the database login information will be carried in a certain field of the message (defined as the login packet). By using specific parsing rules to parse the message, the database login information can be extracted from the message.

[0020] S12: If the target message does not contain the corresponding database login information, then search for the target database login information that matches the first message feature from the preset correspondence relationship; the preset correspondence relationship is the correspondence between the database login information and message features stored in the target database in advance, and the first message feature is the message feature of the target message; Understandably, if the target message itself does not contain the corresponding database login information, it is necessary to further compare the first message feature of the target message with the preset correspondence to determine the target database login information that matches the first message feature. The preset correspondence contains several sets of one-to-one corresponding database login information and message features pre-stored by the target database. When the message features are similar, the database login information corresponding to the similar message features can be used as the target database login information that matches the first message feature, thereby determining the database login information of the target message even when the target message itself does not contain the corresponding database login information.

[0021] It should be noted that, for the convenience of subsequent comparison, correlation, and auditing, the first message feature of the target message and / or the found target database login information can be cached in a preset location for flexible retrieval as needed. For example, the first message feature of the target message can be pre-determined, and during the search, the pre-cached first message feature can be retrieved from the preset location and compared with several message features in a preset correspondence to find the target database login information. This application does not impose any special limitations on the specific type and implementation method of the preset correspondence; it can be implemented through a database login information-message feature mapping table, etc., and can be generated based on historical database auditing operations or directly configured.

[0022] S13: Associate the found target database login information with the target message and record the corresponding association to generate the audit log entry corresponding to the target message.

[0023] It's easy to understand that if a target database login information matching the first message feature of the target message is found in the preset correspondence, it means that the database login information corresponding to the target message is indeed the target database login information. At this point, further association is established between the target message and the target database login information. Finally, based on this association, a complete and traceable audit log entry for the target message is generated. The audited database login information of the target message is written to the audit log and recorded in the corresponding audit log entry. This ensures that all operations and sessions of the target message accurately correspond to their associated database login information in the audit log entries, guaranteeing the integrity and reliability of the audit log. Each audit log entry contains specific database login information and all operation-related content corresponding to that database login information, such as timestamps, operation objects, operation types, and operation results. An audit log entry refers to a single record in the database's audit log.

[0024] It should be noted that database login information refers to the user identity used to access and operate the database system. Specifically, it can be implemented using database login accounts, etc. This application does not impose any particular restrictions on the specific type or implementation method of database login information. Each database login information supports the corresponding operating entity to authenticate itself using a unique username and password, and to perform corresponding database operations according to its permission level. This ensures database security. Different operating entities have different database login information, and each operating entity's database login information is unique.

[0025] Furthermore, this application does not impose specific limitations on the type and implementation method of the target message and target database. The target database can be any database with an authentication mechanism. The target message can specifically be an SQL message implemented based on SQL (Structured Query Language). SQL is a standard programming language used to manage and operate relational databases, and is widely used to perform database operations, including data querying, insertion, updating, and deletion, as well as database structure management and access control. It can be any type of database protocol message, capable of detecting and determining database login information corresponding to messages and statements in various languages, such as API (Application Programming Interface) login account extraction and audit log login account extraction; suitable for various application scenarios requiring authentication, such as database auditing and data security situation awareness platforms.

[0026] This application provides a database auditing method that effectively solves the problems of incomplete audit logs caused by various situations in existing technologies, such as the inability to capture login packets or the deletion of database login information due to periodic cache session cleanup during periods of high access traffic. Even when the database login information of the target packet cannot be directly audited through the login packet, the database login information of the target packet is matched by comparing packet characteristics with preset correspondences. This allows for the auditing of the target packet and its corresponding complete statement's database login information with high accuracy. Combined with the process of directly auditing the database login information of the target packet, this method efficiently extracts database login information from each packet in the database access traffic, achieving a more effective database auditing measure. This ensures the integrity of the audit logs in the database, effectively protects sensitive data in the database, enhances user trust, and strengthens database compliance management.

[0027] As an optional implementation, the target message carries a 5-tuple and client information; the 5-tuple includes the source IP, source port, protocol, destination IP, and destination port of the target message; The first message feature includes the session hash value corresponding to the target message. The session hash value is calculated by concatenating the five-tuple and client information according to a preset format and then using a secure hash algorithm.

[0028] Understandably, in order to achieve unique identification of the database access link, the target message for accessing the target database will carry a five-tuple and client information. This information can uniquely identify a database session. Therefore, the first message characteristics can be determined based on the five-tuple and client information carried in the target message.

[0029] Specifically, the five-tuple and client information of the target packet can be obtained by parsing the target packet. The five-tuple includes the source IP, source port, protocol, destination IP, and destination port of the target packet. Then, the five-tuple and client information are concatenated according to a preset format, and the session hash value corresponding to the target packet is calculated using a secure hash algorithm. The session hash value is then determined as the first packet feature of the target packet.

[0030] Understandably, after parsing the target message, the corresponding 5-tuple, client information, and specific instruction text (such as SQL request statements) can be extracted. At this point, based on the 5-tuple and client information, the session hash value calculated using a specific hash algorithm can serve as the first message feature of the target message, and this first message feature is cached in a preset location. Specifically, SHA1 (Secure Hash Algorithm 1) can be used to calculate the session hash value that characterizes the target message feature. Session hash value = sha1(srcip, srcport, protocol, dstip, dstport, sqlclient). Where srcip is the source IP address of the target message, srcport is the source port of the target message, protocol is the transport protocol of the target message, dstip is the destination IP address of the target message, dstport is the destination port of the target message (i.e., the corresponding database service port), and sqlclient is the client information, which is a client identifier that characterizes the client from which the target message originated; specifically, it can be a username, etc. This application does not impose any special limitations on the preset format and the specific implementation of the secure hash algorithm, and is not limited to the secure hash algorithm 1 of this embodiment. Similarly, this application does not impose any special limitations on the specific parsing method of the target message, which needs to be implemented according to the specific type and implementation method of the target message. If the target message itself has undergone encoding and / or encryption processing, corresponding decoding and / or decryption operations are also required when parsing the target message to ultimately determine the quintuple and client information contained in the target message. Alternatively, the quintuple can be directly used as the first message feature of the target message, and is not limited to the implementation method of the hash value.

[0031] Specifically, session hash values ​​can be used as message characteristics. Session hash values ​​can accurately associate messages and have strong anti-interference and normalization capabilities. They do not contain specific instruction text and can effectively protect data security.

[0032] As an optional embodiment, searching for target database login information that matches the features of the first message from a preset correspondence includes: Find the second message feature from the preset correspondence that has a similarity greater than a preset threshold to the first message feature; The database login information corresponding to the second message feature is determined as the target database login information that matches the first message feature.

[0033] It's easy to understand that the target database login information matching the first message feature can be determined by comparing the similarity between the first message feature and the message features in the preset correspondence. When a second message feature with a high similarity to the first message feature exists in the preset correspondence, the database login information corresponding to the second message feature is determined as the target database login information matching the first message feature. When no second message feature with a high similarity to the first message feature exists in the preset correspondence, it means that no target database login information matching the first message feature can be found in the preset correspondence.

[0034] It should be noted that this application does not impose any special limitations on the method of determining similarity, nor on the value of the preset threshold. These can be set and adjusted according to actual circumstances. For example, when using the five-tuple and client information as the message features, the similarity can be set to the number of identical features among these six features. For instance, if five of the six features of the first message feature are identical to the corresponding five features of a message in a preset correspondence, then the message has a high similarity to the target message, and its corresponding message feature is determined to be the second message feature. Similarly, when using the session hash value as the message feature, the similarity between two messages can be determined by directly comparing whether the two session hash values ​​are identical. If the session hash value of the target message is identical to the session hash value of a message in a preset correspondence, then the message has a high similarity to the target message, and its corresponding message feature is determined to be the second message feature. It can also be further combined with confidence level to match a message that is highly similar to the target message, but this application does not make any special restrictions here.

[0035] Specifically, the similarity between different messages can be compared by parsing message features obtained through different methods such as the five-tuple and client information. Then, the database login information of the target message can be matched based on the database login information of the message similar to the target message, so as to extract the real database login information of the target message without auditing the login packet.

[0036] As an optional embodiment, the access traffic to the target database is parsed to determine whether the target packets in the access traffic contain the corresponding database login information, including: Extract target packets from the access traffic to the target database; Determine the message type of the target message; The target message is parsed based on the parsing method corresponding to the message type to determine whether the target message contains the corresponding database login information.

[0037] Understandably, the access traffic to the target database will contain multiple packets. Therefore, the access traffic first needs to be parsed to extract any one packet as the target packet. Then, the target packet is parsed according to its specific packet type. At this point, some packets may contain database login information. By parsing the target packet using specific methods and extracting key fields, the database login information can be extracted. To facilitate subsequent operations such as determining packet characteristics, after parsing the target packet, the five-tuple, client information, request statements, and response statements are generally extracted into key-value pairs.

[0038] It should be noted that the parsing process of the target message and the operation of parsing the target message when determining the first message characteristics in this embodiment can be implemented through the same parsing process. This application does not impose any special limitations on the specific parsing method of the target message; it needs to be implemented according to the specific type and implementation method of the target message. Different types of messages have different implementation structures, encoding methods, encryption methods, field organization methods, and authentication methods. Therefore, the target message needs to be parsed according to its specific circumstances. If the target message itself has undergone encoding and / or encryption processing, corresponding decoding and / or decryption operations are also required when parsing the target message to ultimately determine the five-tuple and client information contained in the target message.

[0039] Specifically, the corresponding database login information contained in the target message needs to be obtained by parsing the target message. Therefore, the access traffic and the target message can be parsed first to determine whether the target message contains the corresponding database login information. If it does, the database login information contained therein can be directly used to associate and generate audit logs. If it does not, the preset correspondence can be called. The two processes work together to ensure that the database login information in the target message can be audited to the greatest extent.

[0040] See Figure 2 As shown, Figure 2 A flowchart illustrating another database auditing method provided by the present invention; as an optional embodiment, it further includes: If no target database login information matching the first message feature is found in the preset correspondence, simulated login information for the target database is generated. The simulated login information is associated with the target message, and the corresponding association is recorded to generate the audit log entry corresponding to the target message.

[0041] It's easy to understand that when searching for target database login information matching the characteristics of the first message from the preset mapping relationship, there are two scenarios. One is that a matching target database login information can be found, in which case the association and audit log generation can be directly performed based on the matched information. The other scenario is that no matching target database login information matching the characteristics of the first message can be found in the preset mapping relationship. In this case, a simulated login information needs to be generated separately to temporarily serve as the database login information associated with the target message. The simulated login information is then associated with the target message to generate the audit log. Once the real database login information for the target message is extracted or matched at a later time, the audit of the real database login information for that target message can be completed by uniformly replacing the simulated login information.

[0042] It should be noted that this application does not impose any special limitations on the specific implementation method of the simulated login information, as long as it is an identifier that can be distinguished from the database login information. This can be achieved through various identification methods, such as generating a unique ID, or by generating a "temporary account". The simulated login information can be generated based on the first message feature of the target message. If the target database login information that matches the first message feature cannot be found in the preset correspondence, it may be because the preset correspondence of the target database does not yet contain any content, or it may be because the preset correspondence does not contain any message with a high degree of similarity to the target message. This application does not impose any special limitations on this.

[0043] Specifically, for target messages for which no matching first message features can be found in the preset correspondence, this embodiment further ensures the integrity of the audit log by generating temporary simulated login information. Subsequently, the authenticity of the audit log can be further ensured by replacing the simulated login information.

[0044] As an optional embodiment, it also includes: The preset correspondence is updated based on the database login information associated with the target message and the first message feature of the target message; The database login information associated with the target message includes the target database login information found from the preset correspondence, the database login information contained in the target message, and the simulated login information.

[0045] Understandably, whether the database login information contained in the target message is extracted directly from the target message, the target database login information of similar messages is found from the preset correspondence, or temporary simulated login information is generated, once the database login information associated with the target message is determined through these three methods, the association between the newly determined target message and its associated database login information can be written into the preset correspondence to update the preset correspondence and increase the storage capacity of the correspondence in the preset correspondence.

[0046] Specifically, the preset correspondence can be further updated by establishing a correspondence between the newly identified target message, the corresponding first message characteristics, and the associated database login information. This improves the timeliness and comprehensiveness of the preset correspondence and increases the probability that subsequent target messages will find the target database login information from the preset correspondence.

[0047] As an optional embodiment, it also includes: If the target message contains the corresponding database login information, and there is a third message feature in the preset correspondence that matches the first message feature, then it is determined whether the database login information corresponding to the third message feature is simulated login information. If the database login information corresponding to the third message feature is simulated login information, then the database login information corresponding to the third message feature in the preset correspondence will be replaced with the database login information contained in the target message. Replace the simulated login information corresponding to the third message feature in the audit log of the target database with the database login information contained in the target message.

[0048] It is easy to understand that if database login information is subsequently extracted from another target message that is similar to the message corresponding to the simulated login information, the extracted real database login information can be used to replace the preset correspondence and / or the temporary simulated login information in the audit log. At this time, the similarity matching between message features can be used to determine whether the target message corresponding to the extracted real database login information is similar to the message corresponding to the simulated login information, thereby determining whether it is necessary to perform the simulation login information replacement operation and replace all the simulated login information with the real database login information.

[0049] Specifically, in this embodiment, after extracting the real database login information of similar messages, the simulated login information is replaced to ensure the accuracy and authenticity of the login information in the audit log.

[0050] As a specific embodiment, such as Figure 2As shown, taking SQL messages as an example, database login information is implemented using a login account, while simulated login information is implemented using a "temporary account." The SQL access traffic to the database is parsed, and the login packet of any message in the SQL access traffic is identified and extracted. If extraction is successful, it indicates that the target message itself contains the corresponding database login information. At this point, the login account contained in the target message can be directly written to the completed SQL log, completing the audit. On the other hand, it is also necessary to further determine the first message feature of the target message and cache it in a preset location. Then, the first message feature of the target message is compared with each message feature in the preset correspondence. If there are message features with high similarity in the preset correspondence, it is possible to query whether the account currently used by the message corresponding to the message with high similarity is a "temporary account." If so, all "temporary account" entries in all log entries are replaced with the real login account extracted from the login packet. If there are no message features with high similarity in the preset correspondence, the correspondence between the target message, its corresponding first message feature, and its associated login account (database login information extracted from the target message) can be recorded, and the preset correspondence can be updated and a complete SQL log can be generated accordingly.

[0051] On the other hand, if login packet extraction fails, it indicates that the target message does not contain the corresponding database login information. In this case, the first message feature of the target message is determined and cached in a preset location. Then, the first message feature of the target message is compared with each message feature in the preset correspondence. If there is a message feature with high similarity in the preset correspondence, the login account corresponding to the message feature with high similarity can be determined as the login account of the target message. The correspondence between the target message, its corresponding first message feature, and its associated login account (database login information matched from the preset correspondence) is recorded, and the preset correspondence is updated accordingly, and a complete SQL log is generated. If there is no message feature with high similarity in the preset correspondence, a unique ID needs to be generated as the "temporary account" of the target message, and a complete SQL log is generated based on the "temporary account".

[0052] This invention employs a combination of methods—including message feature analysis and comparison, generation of simulated login information, and extraction of database login information contained within the message itself—to achieve efficient extraction of database login information corresponding to messages during database auditing. When a message lacks database login information, the similarity of message features is used to infer the associated database login information. Simultaneously, for target messages that lack a pre-defined corresponding relationship in the database history or do not have a high degree of similarity, a unique simulated login information is generated temporarily as the database login information for the target message. Once the real database login information for a similar message is extracted, the simulated login information is replaced with the real database login information. This combination of methods significantly improves the ability to extract database login information corresponding to SQL messages and SQL statements.

[0053] See Figure 3 As shown, Figure 3 A schematic diagram of the structure of a database auditing device provided by the present invention; secondly, this application discloses a database auditing device, comprising: The parsing unit 11 is used to parse the access traffic of the target database to determine whether the target packets in the access traffic contain the corresponding database login information. The lookup unit 12 is used to search for target database login information that matches the first message feature from a preset correspondence if the target message does not contain the corresponding database login information; the preset correspondence is the correspondence between the database login information and message features stored in the target database in advance, and the first message feature is the message feature of the target message. The association unit 13 is used to associate the found target database login information with the target message and record the corresponding association relationship to generate the audit log entry corresponding to the target message.

[0054] For a description of the database auditing device provided by the present invention, please refer to the embodiments of the database auditing method described above; the present invention will not be described again here.

[0055] See Figure 4 As shown, Figure 4 This is a schematic diagram of the structure of an electronic device provided by the present invention. In a third aspect, this application discloses an electronic device including a processor 21 and a memory 22; wherein the memory 22 is used to store a computer program 222, which is loaded and executed by the processor 21 to implement the database auditing method as described above.

[0056] The processor 21 may include one or more processing cores, such as a quad-core processor or an octa-core processor. The processor 21 may be implemented using at least one hardware form selected from DSP (Digital Signal Processor), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor may also include a main processor and a coprocessor. The main processor, also known as the central processing unit, is used to process data in the wake-up state; the coprocessor is a low-power processor used to process data in the standby state. In some embodiments, the processor 21 may integrate a GPU (graphics processing unit), which is responsible for rendering and drawing the content to be displayed on the screen. In some embodiments, the processor 21 may also include an AI (Artificial Intelligence) processor, which is used to handle computational operations related to machine learning.

[0057] The memory 22 may include one or more computer-readable storage media, which may be non-transitory. The memory 22 may also include high-speed random access memory and non-volatile memory, such as one or more disk storage devices or flash memory devices. In this embodiment, the memory 22 is used to store at least the following computer program 222, which, after being loaded and executed by the processor 21, can implement the relevant steps of the database auditing method disclosed in any of the foregoing embodiments. In addition, the resources stored in the memory 22 may also include an operating system 221 and data, and the storage method may be temporary or permanent storage. The operating system 221 may include Windows, Unix, Linux, etc. The data may include, but is not limited to, the data in the database auditing method.

[0058] In some embodiments, the electronic device may further include a display screen, an input / output interface 25, a communication interface 24, a power supply 23, and a communication bus 26. Those skilled in the art will understand that... Figure 4 The illustration does not constitute a limitation on the electronic device and may include more or fewer components than shown.

[0059] For an introduction to the electronic device provided by this invention, please refer to the embodiments of the database auditing method described above; further details of this invention will not be repeated here.

[0060] Fourthly, this application discloses a computer-readable storage medium for storing a computer program, which, when executed by a processor, implements the database auditing method as described above.

[0061] It is understood that if the methods in the above embodiments are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and executes all or part of the steps of the methods described in the various embodiments of this application. Specifically, the computer-readable storage medium may include, but is not limited to, any type of disk, including floppy disks, optical disks, and portable hard drives, or any type of media or device suitable for storing instructions or data, etc., and this application does not make any special limitations here.

[0062] For an introduction to the computer-readable storage medium provided by the present invention, please refer to the embodiments of the database auditing method described above; the present invention will not be repeated here.

[0063] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatuses disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple; relevant parts can be referred to the method section. Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this application.

[0064] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0065] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0066] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A database auditing method, characterized by, include: The access traffic to the target database is parsed to determine whether the target packets in the access traffic contain the corresponding database login information; If the target message does not contain the corresponding database login information, then the target database login information that matches the first message feature is searched from the preset correspondence relationship; the preset correspondence relationship is the correspondence between the database login information and message features pre-stored by the target database, and the first message feature is the message feature of the target message; The found target database login information is associated with the target message, and the corresponding association is recorded to generate an audit log entry corresponding to the target message.

2. The database auditing method of claim 1, wherein, The target message carries a five-tuple and client information; the five-tuple includes the source IP, source port, protocol, destination IP, and destination port of the target message; The first message feature includes the session hash value corresponding to the target message. The session hash value is calculated by concatenating the five-tuple and the client information according to a preset format and then performing a secure hash algorithm.

3. The database auditing method of claim 1, wherein, Search the preset correspondence for target database login information that matches the features of the first message, including: Find a second message feature from the preset correspondence that has a similarity greater than a preset threshold to the first message feature; The database login information corresponding to the second message feature is determined as the target database login information that matches the first message feature.

4. The database auditing method of claim 1, wherein, The access traffic to the target database is parsed to determine whether the target packets in the access traffic contain the corresponding database login information, including: Extract target packets from the access traffic to the target database; Determine the message type of the target message; The target message is parsed based on the parsing method corresponding to the message type to determine whether the target message contains the corresponding database login information.

5. The database auditing method according to any one of claims 1 to 4, characterized in that, Also includes: If no target database login information matching the first message feature is found in the preset correspondence, then simulated login information of the target database is generated; The simulated login information is associated with the target message, and the corresponding association is recorded to generate an audit log entry corresponding to the target message.

6. The database auditing method of claim 5, wherein, Also includes: The preset correspondence is updated based on the database login information associated with the target message and the first message feature of the target message; The database login information associated with the target message includes the target database login information found from a preset correspondence, the database login information contained in the target message, and the simulated login information.

7. The database auditing method of claim 6, wherein, Also includes: If the target message contains corresponding database login information, and there is a third message feature in the preset correspondence that matches the first message feature, then it is determined whether the database login information corresponding to the third message feature is simulated login information. If the database login information corresponding to the third message feature is simulated login information, then the database login information corresponding to the third message feature in the preset correspondence is replaced with the database login information contained in the target message; Replace the simulated login information corresponding to the third message feature in the audit log of the target database with the database login information contained in the target message.

8. A database auditing device, characterized in that, include: The parsing unit is used to parse the access traffic to the target database to determine whether the target packets in the access traffic contain the corresponding database login information. The lookup unit is configured to search for target database login information that matches the first message feature from a preset correspondence if the target message does not contain the corresponding database login information; the preset correspondence is the correspondence between database login information and message features pre-stored by the target database, and the first message feature is the message feature of the target message; The association unit is used to associate the found target database login information with the target message and record the corresponding association relationship to generate the audit log entry corresponding to the target message.

9. An electronic device, characterized in that, The electronic device includes a processor and a memory; wherein the memory is used to store a computer program, which is loaded and executed by the processor to implement the database auditing method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, Used to store computer programs, which, when executed by a processor, implement the database auditing method as described in any one of claims 1 to 7.

Images