Database instruction management and control method and device with dual-path fusion

Abstract

The application relates to a dual-path fusion database instruction management and control method and device. Through the acquired database instruction, lexical and syntactic analysis is performed to generate an effective word sequence and an analysis result; a structure feature set is generated according to the analysis result; the structure feature set is matched with structure evidence in a preset behavior category to obtain a structure matching degree; the effective word sequence is semantically matched with a corpus set of the behavior category to obtain a semantic matching degree; and based on the fusion result of the structure matching degree and the semantic matching degree, a corresponding management and control action is triggered, thereby solving the problem that a SQL parser is insufficient in capacity and leads to a relatively large safety management and control risk. A dual-path recognition framework combining structure recognition and semantic recognition is used to integrate a behavior intention into instruction recognition, the effectiveness and reliability of database safety management and control are improved, a large number of rules are avoided to be written, and the difficulty of system maintenance and management is further reduced.

Description

Technical Field

[0001] This application relates to the field of database security technology, and in particular to a dual-path fusion database command control method and apparatus. Background Technology

[0002] With the widespread application of database technology in core business systems of finance, government, and enterprises, the security of data assets has become paramount. To defend against SQL injection attacks, prevent sensitive data leaks, and meet compliance audit requirements, database security products must accurately identify and control executed SQL commands, ensuring that only legitimate operations are executed by the database.

[0003] Existing technologies primarily achieve this goal through SQL parsing and rule matching mechanisms. The system first presets a security policy, typically composed of a combination of operation type and operation object; then, it uses an SQL parser to convert the received SQL statement into a structured representation such as an Abstract Syntax Tree (AST); finally, it matches the parsed structural information with preset rules and executes corresponding security control measures based on the matching results, such as allowing or blocking the instruction.

[0004] However, in real-world applications, SQL statements are extremely complex and varied in their combinations. Existing general-purpose SQL parsers often struggle to completely and accurately parse all types of complex statements. If parsing fails or yields incomplete results, security control mechanisms based on the parsing results will fail, preventing security policies from being executed correctly and severely impacting the effectiveness and reliability of database security management. Summary of the Invention

[0005] This embodiment provides a dual-path fusion database command management method and apparatus to solve the problem of poor reliability in database security management in related technologies.

[0006] Firstly, this embodiment provides a dual-path fusion database instruction control method, the method comprising:

[0007] Lexical analysis is performed on the obtained database instructions to generate a valid word sequence; syntactic parsing is performed on the database instructions to generate a parsing result based on an abstract syntax tree;

[0008] Based on the analysis results, a set of structural features is generated; the set of structural features is matched with structural evidence in a preset behavior category to obtain the structural matching degree.

[0009] The effective word sequence is semantically matched with the corpus of the behavior category to obtain the semantic matching degree;

[0010] Based on the fusion result of the structural matching degree and the semantic matching degree, the corresponding control action is triggered.

[0011] In some embodiments, based on the fusion result of the structural matching degree and the semantic matching degree, corresponding control actions are triggered, including:

[0012] Based on the parsing results and the effective word sequence, a multi-dimensional credibility analysis is performed on the parsing results, and the fusion coefficient parsing credibility is obtained based on the results of the multi-dimensional credibility analysis.

[0013] Based on the reliability of the fusion coefficient analysis, the weights of the structural matching degree and the semantic matching degree during fusion are configured, and the fusion matching degree is calculated.

[0014] The corresponding control action is triggered based on the fusion matching degree.

[0015] In some embodiments, a multi-dimensional credibility analysis is performed on the parsing results based on the parsing results and the effective word sequence. The fusion coefficient parsing credibility is obtained based on the results of the multi-dimensional credibility analysis, including:

[0016] Based on the root type identification results, required syntax slot hit rate, and parsing error node ratio obtained from the parsing results, the syntax completeness is calculated.

[0017] Based on the correspondence between the abstract syntax tree in the parsing results and the effective lexical sequence, the lexical coverage rate is calculated.

[0018] Based on the dialect features identified in the parsing results by the effective word sequence, the dialect recognition reliability of the grammar parsing is calculated;

[0019] Based on the grammatical completeness, the lexical coverage, and the dialect recognition reliability, the fusion coefficient resolution reliability is calculated.

[0020] In some embodiments, the dialect recognition reliability of the grammatical parsing is calculated based on the dialect features identified in the parsing results when the effective lexical sequence hits the parsing results, including:

[0021] Dialect features are extracted from the effective word sequence. Based on the parsing results, dialect features are obtained, and a set of candidate features corresponding to the preset candidate dialects and the effective word sequence are obtained.

[0022] For each dialect feature, the number of preset candidate dialects supporting the dialect feature is counted, and the number of candidate feature sets containing the current dialect feature is counted to obtain the dialect discrimination ability. The frequency of occurrence of the dialect feature in the effective word sequence is counted to obtain the dialect hit strength. The candidate dialects include the target dialect used by the grammar parsing and other dialects not used by the grammar parsing.

[0023] For each category of candidate dialects, a credibility score is calculated based on the dialect discrimination ability and dialect hit strength of each dialect feature.

[0024] The dialect recognition reliability is calculated based on the relative difference in reliability scores between the target dialect and the other dialects.

[0025] In some embodiments, the set of structural features is matched with structural evidence in a preset behavior category to obtain a structural matching degree, including:

[0026] The frequency of each structural feature in the effective word sequence is counted to determine the feature strength of the structural feature.

[0027] The cross-class distinguishing weight of each structural feature is determined by counting how many preset behavioral categories of positive structural evidence appear.

[0028] The structural matching degree is calculated based on the cross-category distinguishing weight and the feature strength.

[0029] In some embodiments, the structural matching degree is calculated based on the cross-class distinguishing weights and the feature strengths, including:

[0030] For any of the aforementioned behavior categories, the set of structural features is divided into a set of positive structural features and a set of negative structural features;

[0031] Based on the cross-category discrimination weight and the feature intensity, the positive matching score corresponding to the positive structure feature set and the negative matching score corresponding to the negative structure feature set are calculated respectively.

[0032] Based on the positive and negative matching scores, the structural matching degree for the behavior category is calculated.

[0033] In some embodiments, the effective word sequence is semantically matched with the corpus of the behavior category to obtain a semantic matching degree, including:

[0034] The effective word sequence is divided into a set of sub-words;

[0035] The elements in the sub-word set are filtered and concatenated to form a semantically represented text;

[0036] The semantic representation text is matched with a preset corpus set of each of the behavioral categories to obtain the semantic matching degree.

[0037] The effective word sequence is reconstructed and numerically mapped to form a semantic vector;

[0038] The semantic vector is matched with a preset prototype vector to obtain the semantic matching degree; the prototype vector is generated based on the corpus set of each behavior category.

[0039] In some embodiments, the semantic representation text is matched with a preset corpus set for each of the behavior categories to obtain a semantic matching degree. The effective word sequence is then reconstructed and numerically mapped to form a semantic vector, including:

[0040] Based on the semantically represented text and the corpus sets of each of the aforementioned behavior categories, a unified term space is constructed;

[0041] On the unified term space, the semantic representation text is mapped to obtain a semantic vector;

[0042] On the unified term space, the corpus sets of each behavior category are mapped to obtain the prototype vector of each behavior category;

[0043] Based on the semantic vector and the prototype vector, the semantic matching degree of each behavior category is obtained.

[0044] The effective word sequence is divided into a set of sub-words;

[0045] The elements in the sub-word set are filtered and concatenated to form a semantically represented text;

[0046] The semantic representation text is numerically mapped to form a semantic vector.

[0047] In some embodiments, corresponding control actions are triggered based on the fusion matching degree, including:

[0048] Obtain the threshold for each behavior category and the default control action;

[0049] Based on the relationship between the validity threshold and the fusion matching degree, it is determined whether the behavior corresponding to the behavior category is valid;

[0050] If a single action is valid, the corresponding default control action will be triggered.

[0051] If multiple actions are met, an action decision is made based on the risk level of the default control action.

[0052] If the action is not valid, the release action is triggered.

[0053] Secondly, this embodiment provides a dual-path fusion database instruction control device, the device comprising:

[0054] The preprocessing module is used to perform lexical analysis on the acquired database instructions to generate a valid word sequence; and to perform syntactic parsing on the database instructions to generate a parsing result based on an abstract syntax tree.

[0055] The structure matching module is used to generate a set of structural features based on the parsing results; and to match the set of structural features with structural evidence in a preset behavior category to obtain the structure matching degree.

[0056] The semantic matching module is used to perform semantic matching between the effective word sequence and the corpus set of the behavior category to obtain the semantic matching degree;

[0057] The fusion control module is used to trigger corresponding control actions based on the fusion result of the structural matching degree and the semantic matching degree.

[0058] Thirdly, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the dual-path fusion database instruction control method described in the first aspect.

[0059] Fourthly, this application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, implements the dual-path fusion database instruction control method described in the first aspect.

[0060] Compared with related technologies, the dual-path fusion database instruction control method and apparatus provided in this embodiment generates effective word sequences based on lexical analysis and generates parsing results based on syntax parsing for the acquired database instructions; generates a set of structural features based on the parsing results; matches the set of structural features with structural evidence in preset behavior categories to obtain a structural matching degree; performs semantic matching on the effective word sequences with the corpus set of the behavior categories to obtain a semantic matching degree; and triggers corresponding control actions based on the fusion result of the structural matching degree and the semantic matching degree. This solves the problem of insufficient SQL parser capabilities leading to high security control risks, and constructs a dual-path recognition framework composed of a structural recognition path and a semantic recognition path. By analyzing the behavioral intent of database instructions through the semantic recognition path, the behavioral intent is integrated into instruction recognition, improving the effectiveness and reliability of database security control, avoiding the writing of a large number of rules, and further reducing the difficulty of system maintenance and management.

[0061] Details of one or more embodiments of this application are set forth in the following drawings and description to make other features, objects and advantages of this application more readily apparent. Attached Figure Description

[0062] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0063] Figure 1 This is a hardware structure block diagram of the terminal for the dual-path fusion database instruction control method in this application embodiment;

[0064] Figure 2 This is a flowchart illustrating the dual-path fusion database instruction control method in the first embodiment of this application;

[0065] Figure 3 This is a flowchart illustrating the dual-path fusion database instruction control method in the second embodiment of this application;

[0066] Figure 4 This is a flowchart illustrating the dual-path fusion database instruction control method in the third embodiment of this application;

[0067] Figure 5 This is a structural block diagram of the dual-path fusion database instruction control device in the embodiments of this application.

[0068] Reference numerals: 102, processor; 104, memory; 106, transmission device; 108, input / output device; 51, preprocessing module; 52, structure matching module; 53, semantic matching module; 54, fusion control module. Detailed Implementation

[0069] To better understand the purpose, technical solution, and advantages of this application, the application is described and explained below in conjunction with the accompanying drawings and embodiments.

[0070] Unless otherwise defined, the technical or scientific terms used in this application shall have the general meaning understood by one of ordinary skill in the art to which this application pertains. Words such as “a,” “an,” “an,” “the,” “the,” and “these” used in this application do not indicate quantitative limitation and may be singular or plural. The terms “comprising,” “including,” “having,” and any variations thereof used in this application are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or device that comprises a series of steps or modules (units) is not limited to the listed steps or modules (units) but may include steps or modules (units) not listed, or may include other steps or modules (units) inherent to these processes, methods, products, or devices. Words such as “connected,” “linked,” and “coupled” used in this application are not limited to physical or mechanical connections but may include electrical connections, whether direct or indirect. “Multiple” used in this application refers to two or more. “And / or” describes the relationship between related objects, indicating that three relationships may exist; for example, “A and / or B” can represent: A alone, A and B simultaneously, and B alone. Normally, the character " / " indicates that the objects before and after it are in an "or" relationship. The terms "first," "second," "third," etc., used in this application are merely to distinguish similar objects and do not represent a specific order of objects.

[0071] The method embodiments provided in this example can be executed on a terminal, computer, or similar computing device. For example, it can run on a terminal. Figure 1 This is a hardware structure block diagram of the terminal for the dual-path fusion database instruction control method in this embodiment. For example... Figure 1 As shown, a terminal may include one or more ( Figure 1 Only one is shown in the diagram. A processor 102 and a memory 104 for storing data are also included. The processor 102 may be, but is not limited to, a microprocessor (MCU) or a programmable logic device (FPGA). The terminal may also include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that… Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the terminal described above. For example, the terminal may also include components that are larger than... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown are illustrated.

[0072] The memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to the dual-path fusion database instruction control method in this embodiment. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, thereby implementing the above-described method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0073] The transmission device 106 is used to receive or send data via a network. This network includes a wireless network provided by the terminal's communication provider. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 can be a Radio Frequency (RF) module used for wireless communication with the Internet.

[0074] This embodiment provides a dual-path fusion database command control method. Figure 2 This is a flowchart of the dual-path fusion database instruction control method in this embodiment, as shown below. Figure 2 As shown, the process includes the following steps:

[0075] Step S210: Perform lexical analysis on the obtained database instructions to generate a valid word sequence; perform syntactic parsing on the database instructions to generate a parsing result based on an abstract syntax tree;

[0076] Specifically, database commands are collected through methods such as proxying, bypassing, or direct reception. The collected database commands can be processed by removing redundant whitespace characters, removing comments, standardizing capitalization, and replacing strings and numeric constants with placeholders, outputting a standardized database command q. norm For q norm Perform lexical analysis and syntactic parsing. Lexical analysis includes analyzing q... norm Lexical units (tokens) are generated according to lexical rules. Invalid delimiters are then removed to obtain a valid token sequence, denoted as T = [t_1...t_n]. Syntax parsing includes using a parser to process q...norm Dialect-based syntax parsing is performed, and the output includes: statement root types, such as select (query), insert (insert), update (update), delete (delete), etc.; Abstract Syntax Tree (AST); statement object sets, including database object sets (tables, views), function sets, clause type sets, and target object type sets; and error recovery node N. err (This refers to the number of recovery nodes generated during SQL parsing to allow the syntax tree to continue building after the parser encounters an error; the mapping relationship between AST leaf nodes and valid tokens N) ast (This refers to aligning the leaf nodes in the syntax tree with their corresponding positions in the valid token sequence T).

[0077] Step S220: Based on the parsing results, generate a set of structural features; match the set of structural features with the structural evidence in the preset behavior categories to obtain the structural matching degree;

[0078] Specifically, the parsed information, including the root statement type, object set, function set, clause set, and target object type set, is uniformly converted into a token set U(q) with fixed naming rules, i.e., a structural feature set. The parsing results provide syntactic and semantic information, describing the actual role a term plays in a database instruction. For example: when the parsing result identifies the statement root type as `o=select` (i.e., the statement root type is query), the structural feature `op:select` (where `op` represents the operation type) can be generated; when the parsing result identifies the DDL (Data Definition Language) action as `drop` (deleting an object), the structural feature `verb:drop` (where `verb` represents the operation verb) can be generated; when the parsing result identifies the operation target as `table` (data table) or `schema` (database schema), the structural features `target:table` or `target:schema` (where `target` represents the operation target) can be generated; when the parsing result identifies the function `current_setting` (i.e., a system function that queries the current value of database runtime configuration parameters), the structural feature `func:current_setting` (where `func` represents a function) can be generated; when the parsing result identifies the system objects `pg_roles` (a system view providing information on all database roles) or `pg_auth_members` (a system table storing member relationships between roles), the structural features `sysobj:pg_roles` or `sysobj:pg_auth_members` (where `sysobj` represents a system object) can be generated. This set of structural features is used to match behavior categories. Behavior refers to the security semantic classification of the intent of database commands, such as version detection, permission detection, table deletion / structural corruption, and sensitive data reading.

[0079] Step S230: Semantically match the effective word sequence with the corpus of behavior categories to obtain the semantic matching degree;

[0080] Specifically, the corpus set corresponding to the behavior categories (i.e., the prototype corpus) is shown in Table 1 below.

[0081] Table 1

[0082]

[0083] In the expected set shown in Table 1, c 1,1 and c 1,2 This indicates that the database version and system configuration should be read. 2,1 and c 2,2 This indicates permissions to read role member relationships and data tables, c 3,1 and c 3,2 This indicates that the data table structure has been corrupted, c 4,1and c 4,2 This indicates the ability to read sensitive data such as customer information, accounts, bank card numbers, and mobile phone numbers.

[0084] A deterministic method based on term statistics can be used to vectorize the text of effective word sequences and corpus sets. To ensure the comparability of vectors between different texts, the obtained vectors can be further normalized.

[0085] Step S240: Based on the fusion result of structural matching degree and semantic matching degree, trigger the corresponding control action.

[0086] Specifically, the system obtains the threshold for each behavior category and the default control action. Based on the relationship between the threshold and the fusion result, it determines whether the behavior corresponding to the behavior category is valid. If a single behavior is valid, the corresponding default control action is triggered. If multiple behaviors are valid, the action decision is made based on the risk level of the default control action; for example, the action priority is defined as follows: block > review > alarm > allow. If the behavior is invalid, the allow action is triggered.

[0087] In this embodiment, for the acquired database instructions, a valid word sequence is generated based on lexical analysis, and a parsing result is generated based on syntactic parsing. A structural feature set is generated based on the parsing result. The structural feature set is matched with structural evidence in a preset behavior category to obtain a structural matching degree. The valid word sequence is semantically matched with the corpus of the behavior category to obtain a semantic matching degree. Based on the fusion result of the structural and semantic matching degrees, corresponding control actions are triggered. This solves the problem of insufficient SQL parser capabilities leading to significant security control risks. A dual-path recognition framework consisting of a structural recognition path and a semantic recognition path is constructed. By analyzing the behavioral intent of the database instructions through the semantic recognition path, the behavioral intent is integrated into the instruction recognition, improving the effectiveness and reliability of database security control. It also avoids writing a large number of rules, further reducing the difficulty of system maintenance and management.

[0088] In some of these embodiments, such as Figure 3 As shown, in step S240, based on the fusion result of structural matching degree and semantic matching degree, the corresponding control action is triggered, including:

[0089] Step S241: Perform multi-dimensional credibility analysis based on the parsing results and effective word sequence, and obtain the parsing credibility based on the results of the multi-dimensional credibility analysis;

[0090] Specifically, multi-dimensional credibility analysis includes analyzing the credibility of at least two aspects, such as grammatical integrity, lexical coverage, and dialect recognition, in order to assess and quantify the credibility of the parsing.

[0091] Step S242: Based on the parsing credibility, configure the weights of structural matching degree and semantic matching degree during fusion, and calculate the fusion matching degree;

[0092] Specifically, for each behavior category B i Calculate the corresponding fusion matching degree:

[0093] ;

[0094] Where γ is the structural path weight, determined by the analytical confidence C parse The mapping yields a result satisfying γ∈[0,1], and the result increases with the analytical confidence level C. parse Monotonic change; S str_i S represents the structural matching degree. sem_i γ represents the semantic matching degree. Specifically, when the parsing confidence is high, the structural matching result is more reliable, and γ takes a larger value; when the parsing confidence is low, the grammatical structure information is incomplete or biased, so the structural path weight is reduced and the semantic path weight is increased, thereby maintaining the stability of the matching result.

[0095] In one implementation, the structural path proportion γ is determined by the resolution confidence C. parse Calculated via a constrained Sigmoid mapping:

[0096] ;

[0097] The default parameter is: γ min =0.15, γ max =0.85, k=8, θ γ =0.60.

[0098] This constraint includes: 1. γ min With γ max To ensure that both paths always retain minimum participation, preventing either path from being numerically suppressed; 2.θ γ =0.60 fixes the transition center between "reliable parsing" and "unreliable parsing" in the medium-high confidence region, preventing the parser from misjudging a fully dependent structural path as long as it provides an incomplete AST; 3.k=8 concentrates the transition zone in C. parse The value is approximately 0.60, ensuring that the system can quickly switch to semantic dominance in the low-confidence region and quickly return to structural dominance in the high-confidence region.

[0099] The reason for using a continuous sigmoid function is that complex SQL often exhibits an intermediate state where "partial parsing is available." If a hard switch were used, the system would experience significant fluctuations between adjacent samples. With the constrained sigmoid function described above, the fusion weight (i.e., the fusion matching degree) follows C. parse It changes monotonically and transitions smoothly in the boundary region.

[0100] Step S243: Trigger the corresponding control action based on the fusion matching degree;

[0101] Specifically, the system obtains the threshold for each behavior category and the default control action. Based on the relationship between the threshold and the matching degree, it determines whether the behavior corresponding to the behavior category is valid. If a single behavior is valid, the corresponding default control action is triggered. If multiple behaviors are valid, the action decision is made based on the risk level of the default control action; for example, the action priority is defined as follows: block > review > alarm > allow. If the behavior is invalid, the allow action is triggered.

[0102] In this embodiment, the reliability of the SQL parsing results is quantitatively evaluated, and the parsing credibility is used as a control variable to drive the fusion weight between the structure recognition path and the semantic recognition path, so that the two recognition paths can be continuously and dynamically fused under different parsing credibility conditions.

[0103] In some embodiments, a multi-dimensional credibility analysis is performed based on the parsing results and the effective word sequence. The parsing credibility is obtained based on the results of the multi-dimensional credibility analysis, including:

[0104] Step S310: Based on the root type identification result, required syntax slot hit rate and parsing error node ratio obtained from the parsing result, the syntax completeness is calculated.

[0105] Specifically, based on the statement root type 'o' in the parsing results, the required slot set M is obtained by looking up a table. req (o), based on the set of statement objects in the parsing results, count the number of required slots hit |M hit (o)|, Syntax completeness R of database command parsing syntax The calculation formula is as follows:

[0106] ;

[0107] Among them, when the statement root type is identified, I root =1, otherwise 0; ATS is the parsed abstract syntax tree; N err The number of recovery nodes generated to allow the syntax tree to continue building after the parser encounters an error; N is the total number of tokens in the valid lexical sequence; ε is a numerical stability term, ranging from (0,1), with a default value of 0. .

[0108] The technical constraints of this formula are as follows: the existence of the root type determines whether the structural path can establish a behavioral skeleton, therefore its proportion is fixed at 0.50; the completeness of the required slots determines whether the structural features have sufficient discriminative power, therefore its proportion is fixed at 0.30; the proportion of error recovery nodes reflects the stability of the syntax tree, therefore its proportion is fixed at 0.20. The R obtained from this formula... syntax It can measure whether the parser produces a structural skeleton sufficient to support behavior recognition, and suppress the situation where parsing is completed but the local structure is distorted by the error recovery ratio.

[0109] The default required slots list (partial) is shown in Table 2:

[0110] Table 2

[0111]

[0112] In Table 2, in the "Statement Root Type" column, select indicates a query, insert indicates insertion, update indicates updating, delete indicates deletion, ddl_drop indicates DDL deletion, ddl_alter indicates DDL modification, merge indicates merging, call indicates calling, and unknown indicates unknown. In the default required slot set, projection indicates the query column, from_clause indicates the FROM clause, target_table indicates the target table, insert_source indicates the data source for insertion, set_clause indicates the SET clause, verb indicates the operation verb, target_type indicates the target object type, target_name indicates the target object name, alter_action indicates the modification action, source_clause indicates the source data clause, match_action indicates the matching action, and routine_name indicates the routine name or stored procedure name.

[0113] Step S320: Based on the correspondence between the abstract syntax tree and the effective lexical sequence in the parsing result, calculate the lexical coverage rate;

[0114] Specifically, lexical coverage is defined as:

[0115] ;

[0116] Where ε is the numerical stability term, N ast This represents the number of tokens that have successfully established mappings in the leaf nodes of the AST, where N represents the total number of tokens in the valid token sequence. A valid token is counted in N if and only if it appears at least once in a leaf node of the AST. ast R tokenUsed to measure the actual carrying capacity of the parsed result for the original input token.

[0117] Step S330: Based on the dialect features hit by the effective word sequence, calculate the dialect recognition credibility of the grammatical parsing;

[0118] Specifically, lexical analysis and parsing are two relatively independent processing steps based on the same input. Therefore, based on the dialect features hit in T, the dialect selected for parsing in parsing can be cross-validated, and the reliability of the parsing result can be evaluated accordingly. In other words, the process of calculating the reliability of dialect recognition does not need to re-participate in SQL parsing, but rather determines whether the dialect evidence in the valid token sequence supports the dialect already selected in the parsing stage.

[0119] Step S340: Based on grammatical completeness, lexical coverage, and dialect recognition reliability, the parsing reliability is calculated.

[0120] Specifically, by combining the above three components, we obtain the analytical confidence level C. parse :

[0121] ;

[0122] Among them, R syntax For syntactic completeness, R token R represents the word coverage rate. dialect To assess the reliability of dialect recognition, the weights of each component can be set to a fixed default parameter: α. syn =0.45, α tok =0.35, α dia =0.20; Reasons for weight selection: Syntactic completeness determines whether the structure is usable, so it has the highest weight; Lexical coverage reflects the degree to which the parsing result can carry the input, so it has the second highest weight; Speech recognition reliability is mainly used to correct the reliability of parsing, so it has a relatively low weight.

[0123] In this embodiment, the three items "whether the structure is valid", "whether the coverage is sufficient", and "whether the dialect is credible" are unified into a single continuous index C. parse This helps to stably drive subsequent fusion weights.

[0124] In some embodiments, for step S330, based on the dialect features hit by the effective word sequence, the dialect recognition confidence level corresponding to the grammar parsing is calculated, including:

[0125] Step S331: Extract dialect features from the effective word sequence;

[0126] Step S332: For each dialect feature, count how many preset candidate dialects support the dialect feature to obtain the dialect discrimination ability, and count the frequency of the dialect feature in the effective word sequence to obtain the dialect hit strength; the candidate dialects include the target dialect used by the grammar parsing and other dialects not used by the grammar parsing.

[0127] Specifically, the candidate dialect set D includes candidate dialects d of preset categories, such as D={ANSI-SQL,PostgreSQL}. ANSI-SQL represents the American National Standards Institute Structured Query Language standard, and PostgreSQL represents a relational database. Taking the PostgreSQL dialect as an example, its dialect features can be configured as with recursive, returning, ilike, ::, jsonb, jsonb_path_query_first, current_setting, pg_roles, pg_settings, pg_auth_members, has_table_privilege, etc. The dialect features listed above are canonical expressions, operators, or identifiers of the PostgreSQL database.

[0128] On the one hand, to reflect the differences in dialect discrimination ability among different features, a weight is defined for each dialect feature u_d in the effective word sequence:

[0129] ;

[0130] Where: |D| represents the size of the candidate dialect set, df D (u_d) represents the number of dialect sets D containing feature u_d (i.e., how many dialects support u_d). The meaning of this weight is: the fewer dialects a feature is included in, the stronger its discriminative power, and the higher its weight. Therefore, the weight is used as a measure of dialect discriminative power.

[0131] On the other hand, the frequency of each dialect feature u_d in the database instruction q (specifically, the effective word sequence) is counted (cnt). u_d (q), and define its hit strength as:

[0132] ;

[0133] This function maps the frequency of occurrence to a value in the range of 0-1, so that the feature can make a significant contribution when it first appears, and repeated occurrences will not cause the weight to be linearly amplified.

[0134] Step S333: For each candidate dialect, calculate the credibility score of each candidate dialect based on the dialect discrimination ability and dialect hit strength of dialect features.

[0135] Specifically, for the current database instruction q, the credibility score of each candidate dialect d is defined as follows:

[0136] ;

[0137] Among them, A d This represents the set of dialect features extracted from the effective word sequence that belong to a certain class of candidate dialects d.

[0138] Step S334: Calculate the dialect recognition credibility based on the relative difference in credibility scores between the target dialect and other dialects.

[0139] Specifically, let the target dialect d be the highest score among all candidate dialects. parse The score is G(d) parse The highest score for other dialects was G. other If G(d) parse )=0, or G(d parse ) < G other If the dialect evidence in the valid token sequence does not support the target dialect selected in the grammar parsing stage, then the dialect recognition confidence is 0; if G(d parse )≥G other Then, the dialect recognition reliability is calculated based on the relative difference between the two:

[0140] ;

[0141] Where ε is the numerically stable term; clip indicates truncation to the [0,1] interval. The formula for the confidence level of dialect recognition indicates that: if the dialect selected in the analysis stage has no supporting dialect features, the confidence level is 0; if other dialects score higher than the dialect selected in the analysis stage, it indicates that the independent dialect recognition result is inconsistent with the analyzed dialect, and the confidence level is 0; if the dialect selected in the analysis stage has the highest score, the confidence level is calculated based on the relative difference between its highest score and the highest scores of other dialects; if two dialects are tied for the highest score, the numerator is 0, and the confidence level of dialect recognition is naturally 0, indicating that the existing evidence cannot clearly support the dialect selected in the analysis stage.

[0142] In this embodiment, features appearing only in a few dialects are weighted according to their discriminative ability and have higher weights. The difference between candidate dialects is compared, and the greater the difference between the best and second-best dialects, the more reliable the discrimination. The hit intensity function is used to avoid the same feature appearing multiple times, which would lead to abnormally amplified scores.

[0143] In some embodiments, the structural feature set is matched with structural evidence in a preset behavior category to obtain a structural matching degree, including:

[0144] Step S221: Count the number of occurrences of each structural feature in the effective word sequence to determine the feature strength of the structural feature;

[0145] Specifically, the number of occurrences of any structural feature u_s in the effective word sequence is represented by cnt. u_s (q), whose corresponding feature strength is defined as x u_s for:

[0146] ;

[0147] This function maps the frequency of occurrence to a value in the range of 0-1, so that the feature makes a significant contribution when it first appears, while repeated occurrences do not linearly amplify the effect.

[0148] Step S222: Count how many preset behavioral categories contain positive structural evidence for each structural feature in order to determine the cross-category distinguishing weight of the structural feature.

[0149] Specifically, to reflect the discriminative power of different structural features in behavior recognition, a weight is calculated for each structural feature u_s. First, the number of positive structural evidence (i.e., the set of positive features) in which the statistical feature u_s appears is denoted as df. B (u_s), and define the corresponding initial cross-class discrimination weights:

[0150] ;

[0151] Where M represents the total number of behavior categories. This weight is used to characterize the rarity of a feature; the fewer behavior categories a feature appears in, the stronger its discriminative power. For example, positive and negative features are predefined for each behavior category. Positive features represent behaviors that database commands tend to favor, while negative features represent behaviors that database commands reject. Specifically, the positive feature set for version detection B1 includes {op:select, func:current_setting, sysobj:pg_settings, token:version}, and the negative feature set includes {verb:drop, coltag:sensitive}; the positive feature set for permission version B2 includes {op:select, sysobj:pg_roles, sysobj:pg_auth_members, privfunc:has_table_pri}. The positive feature set for version B3 (deleting tables / destroying structures) includes {verb:drop, verb:truncate, target:table, target:schema, token:cascade}, while the negative feature set includes {op:select}. The positive feature set for version B4 (sensitive data reading) includes {op:select, coltag:id_card, coltag:mobile, coltag:bank_card, obj:customer, obj:account}, while the negative feature set includes {verb:drop}.

[0152] Secondly, for each behavior category B i Mark its key structural features. If feature u_s is a key feature of this behavior, then denote it as mand. i (u_s) = 1, otherwise 0. For behavior B i The structural feature u_s defines its modified cross-class distinguishing weight:

[0153] ;

[0154] Where ρ is the key feature amplification factor, Z i This is a normalization coefficient, ensuring that the sum of all structural feature weights is 1 under this behavior.

[0155] The initial or modified cross-class distinguishing weights can be used as the cross-class distinguishing weights and substituted into step S223 to calculate the structural matching degree. Through the modification mechanism, key features receive higher weights, rare cross-class features receive higher weights, and the weights of general features (such as op:select) are naturally reduced.

[0156] Step S223: Calculate the structural matching degree based on cross-category discrimination weights and feature strengths.

[0157] Specifically, for each behavioral category B i The structural matching degree is obtained by multiplying the cross-category distinction weight and the feature intensity.

[0158] In this embodiment, the effective contribution of structural features in database command SQL is quantified by feature intensity, and the recognition value of rare features is amplified by cross-category differentiation weight. The structural matching degree is calculated by combining the two weighted averages. This not only avoids the interference of general high-frequency features, but also strengthens the distinguishing ability of exclusive features, thereby improving the accuracy and reliability of SQL behavior recognition.

[0159] In some embodiments, for step S223, the structural matching degree is calculated based on cross-class discrimination weights and feature strengths, including:

[0160] Step S410: For any behavior category, divide the structural feature set into a positive structural feature set and a negative structural feature set;

[0161] Specifically, positive and negative features in database command behavior are antagonistic. Positive features characterize the typical structure or semantic signal of the behavior, while negative features depict patterns that are inconsistent with or even conflict with the behavior, thus requiring explicit suppression in scoring. However, the semantic meaning of the same structural feature may change for different behavior categories, making simple categorization inappropriate. For example, database commands containing `verb:drop` should generally be identified as high-risk behavior, but their semantic meaning may change if they simultaneously access system tables or sensitive tables; conversely, complex queries containing numerous sensitive tags should not be misjudged as script attacks simply because of the presence of certain system functions. Based on this, subsequent matching steps must consider both positive and negative features, thus dividing the structural feature set into a positive structural feature set and a negative structural feature set.

[0162] Step S420: Based on cross-class discrimination weights and feature strengths, calculate the positive matching score corresponding to the positive structure feature set and the negative matching score corresponding to the negative structure feature set, respectively.

[0163] Specifically, for each behavior category B i Positive matching score A i And negative matching score E i They are defined as follows:

[0164] ;

[0165] ;

[0166] in, Represents the set of positive structural features. This represents the set of negative structural features.

[0167] Step S430: Based on the positive and negative matching scores, calculate the structural matching degree for the behavior category.

[0168] ;

[0169] Wherein, parameter λ neg Used to control the penalty strength for negative features, with a default value of 0.35, to balance the risks of false positives and false negatives in common business scenarios.

[0170] In this embodiment, the joint calculation of positive and negative matching scores can improve the accuracy of structural matching by characterizing the combined effect of "supporting evidence" and "counter-evidence" within a unified scoring framework.

[0171] In some embodiments, step S230 involves semantically matching the effective word sequence with the corpus of behavior categories to obtain the semantic matching degree, including:

[0172] Step S231: Divide the effective word sequence into a set of sub-words;

[0173] Specifically, this step can be performed in the preprocessing stage before syntax parsing. Specifically, it involves segmenting the tokens in the effective word sequence according to symbols, numbers, and uppercase / lowercase boundaries to generate a sub-word set W(q)={w1,w2,…,wm}.

[0174] Step S232: Filter and concatenate the elements in the sub-word set to form a semantic representation text;

[0175] Specifically, key semantic terms are filtered from W(q) and concatenated in a fixed order. For example, W(q) = [select, customer, card, mobile, account, tenant, status], where tenant and status are not among the matched key semantic terms and are not included in subsequent vector calculations. The resulting semantic representation text is s(q) = "select customercard mobile account".

[0176] Step S233: Match the semantic representation text with the preset corpus set of each behavior category to obtain the semantic matching degree.

[0177] Specifically, semantic representation text and corpus sets of various behavior categories are constructed as vectors, and semantic similarity is calculated through vector matching.

[0178] In this embodiment, irrelevant semantic terms are filtered to simplify the text, eliminate redundant interference, and improve the accuracy of semantic matching.

[0179] In some embodiments, step S233 involves matching the semantic representation text with the corpus sets of each behavior category to obtain the semantic matching degree, including:

[0180] Step S510: Construct a unified term space based on semantically represented text and corpus sets of various behavior categories;

[0181] Step S520: Map the semantic representation text onto the unified term space to obtain a semantic vector;

[0182] Step S530: Map the corpus sets of each behavior category on the unified term space to obtain the prototype vectors of each behavior category;

[0183] Step S540: Based on the semantic vector and prototype vector, obtain the semantic matching degree of each behavior category.

[0184] Specifically, a unified term space is constructed based on the entire corpus of behavioral categories and semantic representation text, for example, V=[select,version,setting,pg_roles,privilege,drop,table,customer,account,Id,card,mobile,sensitive]. The weights of each term in V are calculated, as shown in Table 3.

[0185] Table 3

[0186]

[0187] In Table 3, select represents a query operation, version represents the version number, setting represents a configuration item, pg_roles represents the role table, privilege represents permissions, drop represents deleting an object, table represents a data table, customer represents a customer, account represents an account, card represents a bank card, mobile represents a mobile phone number, and sensitive represents sensitive data.

[0188] Based on the weights of each term in V, the original vector of the semantically represented text in the term space V is obtained as follows:

[0189] ;

[0190] Its mold length is:

[0191] ;

[0192] After normalization, the semantic vector is obtained:

[0193] .

[0194] The prototype vectors for each behavior category can be calculated using the same method.

[0195] The original average vector of version probe B1:

[0196] ;

[0197] Length of the module:

[0198] ;

[0199] After normalization:

[0200] ;

[0201] The original average vector of permission probe B2:

[0202] ;

[0203] The module length is:

[0204] ;

[0205] After normalization:

[0206] ;

[0207] The original average vector of structural failure B3:

[0208] ;

[0209] Length of the module:

[0210] ;

[0211] After normalization:

[0212] ;

[0213] Sensitive reading of the raw average vector of B4:

[0214] ;

[0215] Length of the module:

[0216] ;

[0217] After normalization:

[0218] .

[0219] The normalized semantic vector v sql and prototype vector v beh_i Similarity calculations are performed to obtain the semantic matching degree S corresponding to each behavior category. sem_i :

[0220] ;

[0221] Since the above vectors have all been normalized, the similarity values ​​range from [0,1]. This semantic matching score is used to characterize the semantic expression of the input SQL and the behavior category B. i The degree of similarity.

[0222] In this embodiment, a unified term space is constructed based on the global corpus to complete vector mapping, which not only reduces the amount of unnecessary computation, but also accurately preserves the core business semantics of the database instructions, thereby improving the semantic recognition accuracy and computational efficiency of subsequent behavior matching.

[0223] The present embodiment will now be described and illustrated through preferred embodiments.

[0224] Figure 4 This is a flowchart of a preferred embodiment of a dual-path fusion database instruction control method of this application. Figure 4 As shown, the dual-path fusion database command control method includes the following steps:

[0225] Step S1: Input a database link request and collect the raw database command q. raw As shown below:

[0226] SQL:

[0227] SELECT c.customer_id, c.id_card_no, c.mobile_no / / Specify the query fields

[0228] FROM acct.customer c / / Main table definition

[0229] JOIN acct.account a ON a.customer_id = c.customer_id / / Associated account table

[0230] WHERE c.tenant_id = 42 AND a.status = 'ACTIVE'; / / Filtering condition";

[0231] The SQL structure is complete, containing customer tables, account tables, and sensitive fields such as bank card id_card_no and mobile number mobile_no.

[0232] Step S2, for the original database instruction q raw Preprocessing is performed to remove redundant whitespace characters, comments, and case-consistent values. Strings and numeric constants are replaced with placeholders. The output is a standardized database command q. norm . q norm Lexical units (tokens) are generated according to lexical rules, and invalid separators are further removed to obtain a valid token sequence T (valid token sequence), for example, T=[select,customer_id,id_card_no,mobile_no,acct.customer,acct.account,join,where,tenant_id,status], and the total number of tokens in the valid token sequence is N=10.

[0233] Step S3: Segment the tokens in the effective word sequence according to symbols, numbers and uppercase / lowercase boundaries to generate a sub-word set W(q) = [select, customer, card, mobile, account, tenant, status].

[0234] Step S4, for q norm Perform syntax parsing, the parsing result is R parse For: Statement root type o = select; Database object collection ObjSet = {acct.customer, acct.account}; Function collection FuncSet = Clause type set ClauseSet={join,where}; Target object type set TargetSet={table}; Error recovery node N err =0; Mapping relationship between AST leaf nodes and valid tokens N ast =9; where join is a structural key and is not included in the AST leaf node coverage.

[0235] Step S5: Perform multi-dimensional credibility analysis based on the parsing results and effective word sequence:

[0236] In this example, the syntax root node exists, contains projection (query columns) and the FROM clause, and has no error recovery node. The calculated syntax integrity R is then obtained. syntax =1.0, Lexical Coverage R token =9 / 10=0.9, dialect recognition confidence level dialect=0 (no PostgreSQL features), therefore, the parsing confidence level C parse =0.45×1+0.35×0.9+0.2×0=0.765.

[0237] Step S6, based on the resolution confidence C parse Calculate the structural path weight γ:

[0238] .

[0239] Step S7: Based on the parsing results, generate a set of structural features {op:select,obj:customer,obj:account,coltag:id_card,coltag:mobile}. Calculate the frequency of each structural feature in the effective word sequence and its corresponding feature strength. The calculation results are shown in Table 4.

[0240] Table 4

[0241]

[0242] To determine the cross-class distinguishing weight of each structural feature, we count the number of predefined behavioral categories in which positive structural evidence appears for each feature. Based on the cross-class distinguishing weight and feature strength, we calculate the B for each behavioral category. i Structural matching degree S str_i :

[0243] (1) Version detection B1:

[0244] Positive feature: {op:select,func:current_setting,sysobj:pg_settings,token:version}; Hit:op:select; Weight:op:select weight≈0.1; S str_1 ≈0.1×0.632=0.063;

[0245] (2) Permission detection B2:

[0246] Positive features: {op:select,pg_roles,pg_auth_members,has_table_privilege}; Hit: op:select; S str_2 ≈0.08;

[0247] (3) Delete table B3: Positive feature: {verb:drop / truncate}; Hit: None; S str_3 =0;

[0248] (4) Sensitive reading of B4:

[0249] As before, the cross-class distinction weight ω and feature strength x are shown in Table 5:

[0250] Table 5

[0251]

[0252] calculate:

[0253] ;

[0254] Output: S str =[0.063,0.08,0,0.654].

[0255] Step S8 involves filtering and concatenating elements in the sub-word set W(q). "tenant" and "status" are not part of the core term space used for matching in this example and will not participate in subsequent vector calculations, resulting in the semantic representation text s(q) = "selectcustomer card mobile account". Based on the complete set of behavior prototype corpora and the semantic representation text s(q), a unified term space V = [select, version, setting, pg_roles, privilege, drop, table, customer, account, Id, card, mobile, sensitive] is constructed for this example. The semantic vector v corresponding to the semantic representation text in the term space V is then defined. sql And the prototype vector v corresponding to the pre-set corpus set for each behavior category. beh_i .

[0256] According to the formula: Calculate the semantic matching degree of four types of behaviors:

[0257] S sem_1 =0.391 × 0.325 = 0.127;

[0258] S sem_2 =0.391 × 0.290 = 0.114;

[0259] S sem_3 =0;

[0260] S sem_4 =0.391×0.221+0.443×0.501+0.509×0.288+0.443×0.501+0.443×0.501=0.898;

[0261] Therefore, S sem =[0.127,0.114,0,0.898].

[0262] Step S9, based on the structural path weight γ and the structural matching degree S str_i semantic matching degree S sem_iCalculate the fusion matching degree F item by item i :

[0263] ;

[0264] ;

[0265] ;

[0266] ;

[0267] therefore: .

[0268] Step S10: For each behavior category, the system predefines the threshold for the behavior to be valid and the default control action. It determines whether the fusion matching degree is less than the threshold. If the fusion matching degree is less than the threshold, the behavior is invalid, and a release action is triggered; if the fusion matching degree is greater than or equal to the threshold, the behavior is valid, and a blocking action is triggered. See Table 6.

[0269] Table 6

[0270]

[0271] In this preferred embodiment, on the one hand, the lack of control capabilities due to parsing failure or incomplete parsing results is avoided: parsing reliability is quantitatively evaluated by introducing parsing credibility, and the weight of the semantic recognition path is automatically increased when the parsing credibility is low, so that the system can still output behavior fusion matching degree and execute corresponding control strategies even when parsing fails or the parsing results are incomplete. This invention ensures the accuracy of structure recognition in high parsing credibility scenarios while also enhancing robustness in low parsing credibility scenarios: when the parsing credibility is high, the weight of the structure recognition path is increased to achieve high-precision recognition and control of behaviors with clear structural features; when the parsing credibility is low, the semantic recognition path maintains the coverage and continuity of behavior recognition. On the other hand, the maintenance costs caused by rule expansion and cross-database syntax differences are reduced: the semantic recognition path is used to vectorize and merge similar semantic behaviors, enabling the system to recognize the same operational intent under different expression forms, thereby reducing the need to write rules separately for each SQL expression path, alleviating the problem of rapid rule growth, and reducing the rule maintenance complexity caused by cross-database syntax differences.

[0272] The present application will now be described through a second preferred embodiment.

[0273] Collect database commands to obtain SQL:

[0274] "WITH p AS (

[0275] SELECT

[0276] r.rolname,

[0277] jsonb_path_query_first(

[0278] jsonb_build_object(

[0279] 'm', EXISTS (

[0280] SELECT 1

[0281] FROM pg_auth_members m

[0282] WHERE m.member = r.oid

[0283] ),

[0284] 'p',has_table_privilege(current_user,'acct.customer', 'SELECT')

[0285] ),

[0286] '$.p'

[0287] ) #>> '{}' AS can_read

[0288] FROM pg_roles r

[0289] WHERE r.rolname = current_user )

[0291] SELECT p.rolname, p.can_read

[0292] FROM p

[0293] WHERE p.can_read = 'true'”;

[0294] The above SQL is an example of PostgreSQL permission probing. It primarily determines the current user's role and query permissions for specified tables by querying system tables such as `pg_roles` and `pg_auth_members`, and calling functions like `has_table_privilege` and `jsonb_path_query_first`. This SQL contains PostgreSQL features such as `jsonb_path_query_first`, `jsonb_build_object`, `pg_roles`, `pg_auth_members`, and `has_table_privilege`. While a standard parser can recover part of the "select statement" skeleton, it struggles to fully capture the relationships between JSONB paths, nested `exists` join subqueries, system directories, and permission functions.

[0295] After preprocessing the collected database commands, a valid token sequence is obtained: T=[with,select,jsonb_path_query_first,jsonb_build_object,exists,select,pg_auth_members,where,has_table_privilege,current_user,pg_roles,where,select,can_read,rolname], N=15.

[0296] Further, generate a set of sub-words based on the valid token sequence: W(q)={select,roles,auth,members,privilege,current,user,jsonb,exists}.

[0297] The standard parser only parses a portion of the structure: o = select; ObjSet = {pg_roles}; FuncSet = {has_table_privilege}; ClauseSet = {with, select, where}; TargetSet = {table}; N err =12; N ast =4.

[0298] Calculate the reliability of the analysis:

[0299] ; ; ;

[0300] therefore:

[0301] ;

[0302] Calculate the fusion weights:

[0303] ;

[0304] therefore:

[0305] ;

[0306] In this example, the semantic path weight is higher than the structural path weight.

[0307] Calculate the structural matching degree:

[0308] The main structural features are shown in Table 7:

[0309] Table 7

[0310]

[0311] Among them, the structure matching of the permission probe B2 mainly comes from pg_roles, pg_auth_members, and has_table_privilege:

[0312] ;

[0313] The matching degree for the four types of structures is:

[0314] ;

[0315] Calculate semantic matching degree:

[0316] Using the four types of behavioral prototype corpus Ci from Table 1, including version detection, permission detection, structural destruction, and sensitive reading semantic templates, we filter key semantic terms from W(q) and normalize has_table_privilege to privilege, resulting in:

[0317] s(q)="select roles auth members privilege current user".

[0318] Using the same method as in Example 1, a unified term space is constructed, and the semantic vector of the input SQL is calculated:

[0319] ;

[0320] Length of the module:

[0321] ;

[0322] After normalization:

[0323] ;

[0324] Among them, the four types of behavioral prototype vectors are generated by their respective C according to the same rules as in Example 1. i The results were calculated. To avoid repetition, this article only lists the final semantic matching calculation results.

[0325] The semantic matching degree meter uses:

[0326] ;

[0327] The four semantic matching degrees are:

[0328] ;

[0329] The result indicates that the input SQL and permission probes highly overlap in terms such as roles, auth, members, and privilege. It was significantly higher than other behavioral categories.

[0330] Calculate the fusion matching degree:

[0331] ;

[0332] Calculate item by item:

[0333] ;

[0334] ;

[0335] ;

[0336] ;

[0337] therefore:

[0338] ;

[0339] The final control actions are shown in Table 8.

[0340] Table 8

[0341]

[0342] Hit behavior: B2 permission detection, the final action is verification.

[0343] The unified generation rule for sensitive tags is as follows: based on a set of sub-words, they are mapped to sensitive tags according to a fixed dictionary. If the deployment parameters are not specified, the default dictionary is shown in Table 9 below:

[0344] Table 9

[0345]

[0346] As shown in Table 9, when any sub-word after segmenting a column name matches the above set, a corresponding sensitive label coltag: X (where X represents any one of the following: bank card, mobile number, email, address, password, etc.) is generated and counted once.

[0347] In addition, in this embodiment, the unified source of behavior category, structure template, semantic prototype ID, behavior establishment threshold, and control action can be referred to Table 10.

[0348] Table 10

[0349]

[0350] To facilitate the explanation of the technical principles of this invention, the above examples have been appropriately simplified in terms of data scale and some computational details. Specifically, the number of tokens, feature scale, and prototype corpus size have been reduced, and representative values ​​have been used for some intermediate calculation processes to highlight the logical relationships between each step and the role of the parameters. Meanwhile, Example 2, while maintaining the integrity of the step chain, has appropriately merged the computational processes already detailed in Example 1, retaining only the key calculation results to avoid repetitive descriptions. These simplifications do not affect the integrity and technical effectiveness of the method of this invention; in practical applications, calculations can be performed based on the complete data scale.

[0351] It should be noted that the steps shown in the above process or in the flowchart of the accompanying figures can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0352] This embodiment also provides a dual-path fusion database instruction control device, which is used to implement the above embodiments and preferred embodiments; details already described will not be repeated. The terms "module," "unit," "subunit," etc., used below refer to combinations of software and / or hardware that implement a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0353] Figure 5 This is a structural block diagram of the dual-path fusion database instruction control device in this embodiment, as shown below. Figure 5 As shown, the device includes: a preprocessing module 51, a structure matching module 52, a semantic matching module 53, and a fusion control module 54.

[0354] The preprocessing module 51 is used to perform lexical analysis on the acquired database instructions to generate a valid word sequence; and to perform syntactic parsing on the database instructions to generate parsing results based on an abstract syntax tree.

[0355] The structure matching module 52 is used to generate a set of structural features based on the parsing results; and to match the set of structural features with structural evidence in a preset behavior category to obtain a structure matching degree.

[0356] The semantic matching module 53 is used to perform semantic matching between the effective word sequence and the corpus set of the behavior category to obtain the semantic matching degree;

[0357] The fusion control module 54 is used to trigger corresponding control actions based on the fusion result of the structural matching degree and the semantic matching degree.

[0358] In some embodiments, based on the fusion result of the structural matching degree and the semantic matching degree, corresponding control actions are triggered, including:

[0359] Based on the parsing results and the effective word sequence, a multi-dimensional credibility analysis is performed on the parsing results, and the fusion coefficient parsing credibility is obtained based on the results of the multi-dimensional credibility analysis.

[0360] Based on the reliability of the fusion coefficient analysis, the weights of the structural matching degree and the semantic matching degree during fusion are configured, and the fusion matching degree is calculated.

[0361] The corresponding control action is triggered based on the fusion matching degree.

[0362] In some embodiments, a multi-dimensional credibility analysis is performed on the parsing results based on the parsing results and the effective word sequence. The fusion coefficient parsing credibility is obtained based on the results of the multi-dimensional credibility analysis, including:

[0363] Based on the root type identification results, required syntax slot hit rate, and parsing error node ratio obtained from the parsing results, the syntax completeness is calculated.

[0364] Based on the correspondence between the abstract syntax tree in the parsing results and the effective lexical sequence, the lexical coverage rate is calculated.

[0365] Based on the dialect features identified in the parsing results by the effective word sequence, the dialect recognition reliability of the grammar parsing is calculated;

[0366] Based on the grammatical completeness, the lexical coverage, and the dialect recognition reliability, the fusion coefficient resolution reliability is calculated.

[0367] In some embodiments, the dialect recognition reliability of the grammatical parsing is calculated based on the dialect features identified in the parsing results when the effective lexical sequence hits the parsing results, including:

[0368] Dialect features are extracted from the effective word sequence. Based on the parsing results, dialect features are obtained, and a set of candidate features corresponding to the preset candidate dialects and the effective word sequence are obtained.

[0369] For each dialect feature, the number of preset candidate dialects supporting the dialect feature is counted, and the number of candidate feature sets containing the current dialect feature is counted to obtain the dialect discrimination ability. The frequency of occurrence of the dialect feature in the effective word sequence is counted to obtain the dialect hit strength. The candidate dialects include the target dialect used by the grammar parsing and other dialects not used by the grammar parsing.

[0370] For each category of candidate dialects, a credibility score is calculated based on the dialect discrimination ability and dialect hit strength of each dialect feature.

[0371] The dialect recognition credibility is calculated based on the relative difference in credibility scores between the target dialect and other dialects.

[0372] In some embodiments, the set of structural features is matched with structural evidence in a preset behavior category to obtain a structural matching degree, including:

[0373] The frequency of each structural feature in the effective word sequence is counted to determine the feature strength of the structural feature.

[0374] The cross-class distinguishing weight of each structural feature is determined by counting how many preset behavioral categories of positive structural evidence appear.

[0375] The structural matching degree is calculated based on the cross-category distinguishing weight and the feature strength.

[0376] In some embodiments, the structural matching degree is calculated based on the cross-class distinguishing weights and the feature strengths, including:

[0377] For any of the aforementioned behavior categories, the set of structural features is divided into a set of positive structural features and a set of negative structural features;

[0378] Based on the cross-category discrimination weight and the feature intensity, the positive matching score corresponding to the positive structure feature set and the negative matching score corresponding to the negative structure feature set are calculated respectively.

[0379] Based on the positive and negative matching scores, the structural matching degree for the behavior category is calculated.

[0380] In some embodiments, the effective word sequence is semantically matched with the corpus of the behavior category to obtain a semantic matching degree, including:

[0381] The effective word sequence is divided into a set of sub-words;

[0382] The elements in the sub-word set are filtered and concatenated to form a semantically represented text;

[0383] The semantic representation text is matched with a preset corpus set of each of the behavioral categories to obtain the semantic matching degree.

[0384] The effective word sequence is reconstructed and numerically mapped to form a semantic vector;

[0385] The semantic vector is matched with a preset prototype vector to obtain the semantic matching degree; the prototype vector is generated based on the corpus set of each behavior category.

[0386] In some embodiments, the semantic representation text is matched with a preset corpus set for each of the behavior categories to obtain a semantic matching degree. The effective word sequence is then reconstructed and numerically mapped to form a semantic vector, including:

[0387] Based on the semantically represented text and the corpus sets of each of the aforementioned behavior categories, a unified term space is constructed;

[0388] On the unified term space, the semantic representation text is mapped to obtain a semantic vector;

[0389] On the unified term space, the corpus sets of each behavior category are mapped to obtain the prototype vector of each behavior category;

[0390] Based on the semantic vector and the prototype vector, the semantic matching degree of each behavior category is obtained.

[0391] The effective word sequence is divided into a set of sub-words;

[0392] The elements in the sub-word set are filtered and concatenated to form a semantically represented text;

[0393] The semantic representation text is numerically mapped to form a semantic vector.

[0394] In some embodiments, corresponding control actions are triggered based on the fusion matching degree, including:

[0395] Obtain the threshold for each behavior category and the default control action;

[0396] Based on the relationship between the validity threshold and the fusion matching degree, it is determined whether the behavior corresponding to the behavior category is valid;

[0397] If a single action is valid, the corresponding default control action will be triggered.

[0398] If multiple actions are met, an action decision is made based on the risk level of the default control action.

[0399] If the action is not valid, the release action is triggered.

[0400] It should be noted that the above modules can be functional modules or program modules, and can be implemented through software or hardware. For modules implemented through hardware, the above modules can reside in the same processor; or the above modules can be located in different processors in any combination.

[0401] This embodiment also provides a computer device, including a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform the steps in any of the above method embodiments.

[0402] Optionally, the computer device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor and the input / output device is connected to the processor.

[0403] It should be noted that the specific examples in this embodiment can refer to the examples described in the above embodiments and optional implementations, and will not be repeated in this embodiment.

[0404] Furthermore, in conjunction with the dual-path fusion database instruction control method provided in the above embodiments, this embodiment can also provide a storage medium for implementation. This storage medium stores a computer program; when executed by a processor, the computer program implements any one of the dual-path fusion database instruction control methods in the above embodiments.

[0405] It should be understood that the specific embodiments described herein are merely illustrative of the application and not intended to limit it. All other embodiments derived by those skilled in the art based on the embodiments provided in this application without inventive effort are within the scope of protection of this application.

[0406] Obviously, the accompanying drawings are merely some examples or embodiments of this application. Those skilled in the art can apply this application to other similar situations based on these drawings without any creative effort. Furthermore, it is understood that although the work done in this development process may be complex and lengthy, for those skilled in the art, certain design, manufacturing, or production modifications made based on the technical content disclosed in this application are merely conventional technical means and should not be considered as insufficient disclosure of this application.

[0407] The term "embodiment" in this application refers to a specific feature, structure, or characteristic described in connection with an embodiment that may be included in at least one embodiment of this application. The appearance of this phrase in various places in the specification does not necessarily imply the same embodiment, nor does it imply that it is mutually exclusive with or independent of other embodiments. It will be clearly or implicitly understood by those skilled in the art that the embodiments described in this application may be combined with other embodiments without conflict.

[0408] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of patent protection. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the appended claims.

Claims

1. A dual-path fusion database command control method, characterized in that, The method includes: Lexical analysis is performed on the obtained database instructions to generate a valid word sequence; syntactic parsing is performed on the database instructions to generate a parsing result based on an abstract syntax tree; Based on the analysis results, a set of structural features is generated; the set of structural features is matched with structural evidence in a preset behavior category to obtain the structural matching degree. The effective word sequence is semantically matched with the corpus of the behavior category to obtain the semantic matching degree; Based on the fusion result of the structural matching degree and the semantic matching degree, a corresponding control action is triggered, specifically including: performing multi-dimensional credibility analysis based on the parsing result and the effective word sequence, obtaining the parsing credibility based on the result of the multi-dimensional credibility analysis; configuring the weights of the structural matching degree and the semantic matching degree during fusion based on the parsing credibility, and calculating the fusion matching degree; triggering the corresponding control action based on the fusion matching degree. The process involves performing a multi-dimensional credibility analysis based on the parsing results and the effective word sequence. The parsing credibility is then obtained based on the results of this multi-dimensional credibility analysis, including: Based on the root type identification results, required syntax slot hit rate, and parsing error node ratio obtained from the parsing results, the syntax completeness is calculated. Based on the correspondence between the abstract syntax tree in the parsing results and the effective lexical sequence, the lexical coverage rate is calculated. Based on the dialect features hit by the effective word sequence, the dialect recognition reliability of the grammar parsing is calculated; Based on the grammatical completeness, the lexical coverage, and the dialect recognition reliability, the parsing reliability is calculated.

2. The dual-path fusion database instruction control method according to claim 1, characterized in that, Based on the dialect features hit by the effective lexical sequence, the dialect recognition reliability of the grammar parsing is calculated, including: Extract dialect features from the effective word sequence; For each dialect feature, the number of preset candidate dialects supporting the dialect feature is counted to obtain the dialect discrimination ability. The frequency of occurrence of the dialect feature in the effective word sequence is counted to obtain the dialect hit strength. The candidate dialects include the target dialect used by the grammar parsing and other dialects not used by the grammar parsing. For each candidate dialect, a credibility score is calculated based on the dialect discrimination ability and dialect hit strength of the dialect features. The dialect recognition credibility is calculated based on the relative difference in credibility scores between the target dialect and the other dialects.

3. The dual-path fusion database instruction control method according to claim 1, characterized in that, The structural feature set is matched with structural evidence in a preset behavior category to obtain the structural matching degree, including: The frequency of each structural feature in the effective word sequence is counted to determine the feature strength of the structural feature. The cross-class distinguishing weight of each structural feature is determined by counting how many preset behavioral categories of positive structural evidence appear. The structural matching degree is calculated based on the cross-category discrimination weight and the feature strength.

4. The dual-path fusion database instruction control method according to claim 3, characterized in that, Based on the cross-category discrimination weights and the feature strengths, the structural matching degree is calculated, including: For any of the aforementioned behavior categories, the set of structural features is divided into a set of positive structural features and a set of negative structural features; Based on the cross-category discrimination weight and the feature intensity, the positive matching score corresponding to the positive structure feature set and the negative matching score corresponding to the negative structure feature set are calculated respectively. Based on the positive and negative matching scores, the structural matching degree for the behavior category is calculated.

5. The dual-path fusion database instruction control method according to claim 1, characterized in that, The effective word sequence is semantically matched with the corpus of the behavior category to obtain the semantic matching degree, including: The effective word sequence is divided into a set of sub-words; The elements in the sub-word set are filtered and concatenated to form a semantically represented text; The semantic representation text is matched with a preset corpus set of each of the aforementioned behavior categories to obtain the semantic matching degree.

6. The dual-path fusion database instruction control method according to claim 5, characterized in that, The semantic representation text is matched with a preset corpus set for each of the aforementioned behavior categories to obtain the semantic matching degree, including: Based on the semantically represented text and the corpus sets of each of the aforementioned behavior categories, a unified term space is constructed; On the unified term space, the semantic representation text is mapped to obtain a semantic vector; On the unified term space, the corpus sets of each behavior category are mapped to obtain the prototype vector of each behavior category; Based on the semantic vector and the prototype vector, the semantic matching degree of each behavior category is obtained.

7. The dual-path fusion database instruction control method according to claim 1, characterized in that, Based on the fusion matching degree, corresponding control actions are triggered, including: Obtain the threshold for each behavior category and the default control action; Based on the relationship between the validity threshold and the fusion matching degree, it is determined whether the behavior corresponding to the behavior category is valid; If a single action is valid, the corresponding default control action will be triggered. If multiple behaviors are met, an action decision is made based on the risk level of the default control action. If the action is not valid, the release action is triggered.

8. A dual-path fusion database instruction control device, characterized in that, The device includes: The preprocessing module is used to perform lexical analysis on the acquired database instructions to generate a valid word sequence; and to perform syntactic parsing on the database instructions to generate a parsing result based on an abstract syntax tree. The structure matching module is used to generate a set of structural features based on the parsing results; and to match the set of structural features with structural evidence in a preset behavior category to obtain the structure matching degree. The semantic matching module is used to perform semantic matching between the effective word sequence and the corpus set of the behavior category to obtain the semantic matching degree; The fusion control module is used to trigger corresponding control actions based on the fusion result of the structural matching degree and the semantic matching degree. Specifically, it includes: performing multi-dimensional credibility analysis based on the parsing result and the effective word sequence; obtaining the parsing credibility based on the result of the multi-dimensional credibility analysis; configuring the weights of the structural matching degree and the semantic matching degree during fusion based on the parsing credibility, and calculating the fusion matching degree; and triggering corresponding control actions based on the fusion matching degree. Specifically, a multi-dimensional credibility analysis is performed based on the parsing results and the effective lexical sequence. The parsing credibility is obtained based on the results of the multi-dimensional credibility analysis, including: calculating the grammatical completeness based on the root type identification results, required grammatical slot hit rate, and parsing error node ratio obtained from the parsing results; calculating the lexical coverage rate based on the correspondence between the abstract syntax tree in the parsing results and the effective lexical sequence; calculating the dialect recognition credibility of the grammatical parsing based on the dialect features hit by the effective lexical sequence; and calculating the parsing credibility based on the grammatical completeness, the lexical coverage rate, and the dialect recognition credibility.

Images