Intrusion detection method, electronic device, storage medium, and computer program product

Abstract

This application provides an intrusion detection method, electronic device, storage medium, and computer program product. The method includes: acquiring a Structured Query Language (SQL) operation log from a database; encoding the SQL operation log into a time-series image, wherein a first dimension feature of the time-series image corresponds to the time sequence of the SQL operation log, and a second dimension feature of the time-series image corresponds to the SQL operation type of the SQL operation log; inputting the time-series image into a target detection model to obtain a detection result output by the target detection model, wherein the target detection model is used to detect intrusion behavior; when the detection result indicates the existence of intrusion behavior, assessing the security risk of the intrusion behavior to obtain a risk response level for the intrusion behavior; and executing an interception operation corresponding to the risk response level. This application's solution can improve the false negative rate of intrusion detection.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to an intrusion detection method, electronic device, storage medium, and computer program product. Background Technology

[0002] Database intrusion detection, as an important branch of network security, aims to identify and prevent unauthorized access and malicious operations against databases, thereby protecting the security of data stored within the database. Intrusion Detection Systems (IDS) are a mainstream security technology that can monitor and analyze network data flows and system activities in real time to identify potential security risks.

[0003] As database attack methods continue to evolve and become more sophisticated, the disguise and concealment of various intrusion behaviors are constantly increasing, significantly increasing the difficulty of database intrusion detection. Current database intrusion detection mechanisms struggle to effectively distinguish between normal business activities and disguised intrusions, resulting in a high false negative rate and failing to meet the protection requirements of databases. Summary of the Invention

[0004] To address the related technical problems, embodiments of this application provide an intrusion detection method, an electronic device, a storage medium, and a computer program product.

[0005] The technical solution of this application embodiment is implemented as follows: This application provides an intrusion detection method, the method comprising: Retrieve the database's Structured Query Language (SQL) operation logs; The SQL operation log is encoded into a time-series image, wherein the first dimension feature of the time-series image corresponds to the time sequence of the SQL operation log, and the second dimension feature of the time-series image corresponds to the SQL operation type of the SQL operation log; The time-series image is input into the target detection model to obtain the detection result output by the target detection model, wherein the target detection model is used to detect intrusion behavior; If the detection result indicates the presence of intrusion, the security risk of the intrusion is assessed to obtain the risk response level of the intrusion. Perform the interception operation corresponding to the risk response level.

[0006] In the above scheme, encoding the SQL operation log into a time-series image includes: Based on the operation attributes of the SQL operation log, the SQL operation log is encoded into a time-series image; wherein, the operation attributes include a security risk coefficient, operation frequency, and IP address; the time-series image includes a first color channel, a second color channel, and a third color channel, wherein the first color channel corresponds to the security risk coefficient, the second color channel corresponds to the operation frequency, and the third color channel corresponds to the IP address.

[0007] In the above solution, obtaining the SQL operation logs of the database includes: Retrieve database logs; Filter out non-SQL operation records from the database log to obtain the filtered database log; The missing fields in the filtered database logs are filled to obtain the filled database logs. The database logs after the filling process are standardized to obtain the SQL operation logs.

[0008] In the above scheme, the target detection model includes an input layer, a backbone network, a neck network, and a head network; the step of inputting the temporal image into the target detection model and obtaining the detection result output by the target detection model includes: The time series image is input into the input layer, and the input layer is used to map the time series image to a preset size; The time-series image of the preset size is input into the backbone network, and the image features of the time-series image are extracted using the backbone network to obtain the first feature map of the time-series image; The first feature map is input into the neck network to obtain a second feature map; wherein, the neck network includes a feature pyramid network with a temporal attention mechanism; The second feature map is input into the head network to obtain the detection result, wherein the detection result includes the image coordinates, risk category, confidence level and temporal continuity score corresponding to the intrusion behavior, and the temporal continuity score is used to evaluate the duration of the intrusion behavior.

[0009] The method in the above scheme further includes: Obtain a training set, wherein the training set includes multiple sample images and sample labels corresponding to each sample image, and the sample images are obtained by encoding the historical operation logs of the database; Each sample image in the training set is input into the target detection model to obtain the output result of the target detection model; Based on the output results and the corresponding sample labels, the model loss is calculated; wherein, the model loss includes localization loss, classification loss and temporal continuity loss, the localization loss is used to measure the deviation between the image coordinates of the output results and the image coordinates of the sample labels, the classification loss is used to measure the deviation between the risk category of the output results and the risk category of the sample labels, and the temporal continuity loss is used to measure the deviation between the temporal continuity score of the output results and the temporal continuity score of the sample labels. The network parameters of the target detection model are adjusted based on the model loss to obtain an optimized target detection model; After multiple rounds of optimization, the trained target detection model was obtained.

[0010] In the above scheme, the step of performing the interception operation corresponding to the risk response level includes: If the risk response level is the first response level, a warning message for the intrusion behavior is generated; If the risk response level is the second response level, a rollback operation will be performed on the transaction corresponding to the intrusion behavior; If the risk response level is level three, the session corresponding to the intrusion behavior will be terminated. The risk response levels corresponding to the first response level, the second response level, and the third response level increase sequentially.

[0011] The method in the above scheme further includes: On the time-series image, image regions corresponding to intrusion behaviors of different durations are marked by detection boxes of different sizes.

[0012] This application provides an electronic device, including: a processor and a memory for storing a computer program capable of running on the processor; wherein, when the processor runs the computer program, it executes the steps of the method provided in this application.

[0013] This application provides a storage medium storing a computer program or computer-executable instructions thereon. When the computer program or computer-executable instructions are executed by a processor, they implement the steps of the method provided in this application.

[0014] This application provides a computer program product, including a computer program or computer executable instructions, which, when executed by a processor, implement the steps of the method provided in this application.

[0015] The intrusion detection method, electronic device, storage medium, and computer program product provided in this application convert SQL logs from a database into time-series images. These images visually represent the spatiotemporal characteristics of intrusion behavior through pixel distribution. The time-series images are then input into a target detection model to detect intrusion behavior, yielding the model's output detection results. This combination of intrusion detection and target detection reduces the difficulty of intrusion detection, improves its accuracy, and lowers the false negative rate. When the target detection model's output indicates the presence of intrusion behavior, the security risk of the intrusion is assessed to determine its risk response level. Interception operations corresponding to the risk response level are then executed, thereby improving the response rate, shortening response time, saving manual operations, and achieving timely blocking of intrusion behavior. Attached Figure Description

[0016] Figure 1 This is a flowchart illustrating an intrusion detection method provided in an embodiment of this application; Figure 2 This is a schematic diagram illustrating the framework of an application example of an intrusion detection method provided in this application embodiment; Figure 3 This is a schematic diagram of the structure of an intrusion detection device provided in an embodiment of this application; Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of this application clearer, the application will now be described in further detail with reference to the accompanying drawings.

[0018] Databases, as data storage media, are responsible for data reading, writing, storage, and interaction, and are the foundation of digital systems. Databases provide data reading, writing, and storage functions for terminal devices or servers. With the diversification of database services and the increasing frequency of database access, database intrusion attempts have also increased significantly.

[0019] Database intrusion detection is an important branch of cybersecurity. It aims to identify and prevent unauthorized access or malicious operations to protect sensitive information in databases. Currently, database intrusion detection methods mainly include: rule-based detection methods, statistical analysis-based detection methods, machine learning-based detection methods, and data mining-based detection methods. These methods primarily monitor database access behavior, analyze log files and network traffic, and use predefined rules or machine learning models to identify abnormal or known attack behaviors.

[0020] However, the above-mentioned data intrusion detection methods still have some limitations, mainly including the following: First, its intrusion detection capabilities are limited, only able to identify known attack behaviors. Its ability to identify new attack behaviors that have been modified or disguised is limited. When faced with complex and constantly evolving attack behaviors, it is difficult to distinguish disguised attack behaviors from normal business access behaviors, resulting in low detection accuracy and a high false negative rate.

[0021] Second, the intrusion behavior analysis model is singular and rigid, lacking generalization ability.

[0022] Third, it has poor real-time performance and a lengthy intrusion response process, usually adopting a response method of reporting to alarms and then manual processing, which is difficult to meet the real-time detection needs in high-concurrency database scenarios.

[0023] Based on this, this application provides an intrusion detection scheme. By converting the SQL logs of the database into time-series images, the spatiotemporal characteristics of intrusion behavior are intuitively presented through the pixel distribution of the time-series images. The time-series images are input into a target detection model, which detects intrusion behavior and obtains the detection results output by the target detection model. This combines intrusion detection with target detection, reducing the difficulty of intrusion behavior detection, improving the accuracy of intrusion behavior detection, and reducing the false negative rate. When the detection results output by the target detection model indicate the existence of intrusion behavior, the security risk of the intrusion behavior is assessed to determine the risk response level of the intrusion behavior. Interception operations corresponding to the risk response level are then executed, thereby improving the response rate of intrusion behavior, shortening the response time, saving manual operations, and achieving timely blocking of intrusion behavior. This effectively defends against security risks that databases may face, such as SQL injection and abnormal transactions, providing a more efficient and comprehensive protection scheme for the secure operation of the database.

[0024] The intrusion detection scheme provided by the embodiments of this application is described below. First, the embodiments of this application provide an intrusion detection method. The intrusion detection method provided by the embodiments of this application is executed using an electronic device as an example. The electronic device in the embodiments of this application is a terminal device or server with intrusion detection capabilities, such as a cloud server, a protection server, or other devices. Alternatively, the electronic device can be used to drive or be integrated into an intrusion detection system. The embodiments of this application do not limit the specific form of the electronic device.

[0025] like Figure 1 As shown in the embodiments of this application, the intrusion detection method includes the following steps: Step 101: Obtain the SQL operation log of the database; Step 102: Encode the SQL operation log into a time series image. The first dimension of the time series image corresponds to the time series of the SQL operation log, and the second dimension corresponds to the SQL operation type of the SQL operation log. Step 103: Input the time series image into the target detection model to obtain the detection result output by the target detection model. This target detection model is used to detect intrusion behavior. Step 104: If the detection results indicate the presence of intrusion, assess the security risk of the intrusion to obtain the risk response level of the intrusion. Step 105: Execute the interception operation corresponding to the risk response level.

[0026] In practical applications, SQL operation logs are structured logs that record SQL operation data. For example, SQL operation logs record data related to SQL operations such as database read / write, data modification, and data deletion. Electronic devices can directly collect SQL operation logs. For instance, an electronic device can capture transaction records, including one or more SQL statements, in real time through a database's log interface to obtain the SQL operation log.

[0027] The SQL operation log contains multiple SQL operation records. Each SQL operation record includes one or more of the following operation data: timestamp, operation type (i.e., SQL operation type), security risk coefficient, operation frequency, user identifier, and Internet Protocol (IP) address (one or more can be understood as at least one).

[0028] A timestamp indicates the moment an SQL operation occurs. In this embodiment, the timestamp of each SQL operation record is accurate to the second. Timestamps provide the temporal sequence of SQL operations.

[0029] Operation type indicates the category of SQL operation, and can also be called SQL operation type. For example, operation types include various categories of SQL operations such as query operation (SELECT), insert operation (INSERT), update operation (UPDATE), delete operation (DELETE), and destroy operation (DROP). Electronic devices can determine the operation category by recognizing keywords in the SQL statement.

[0030] The security risk coefficient represents a predefined quantitative value of security risk, used to characterize the inherent danger level of a single SQL operation. For example, the security risk coefficient for a query operation is 0, and the security risk coefficient for an insert operation is 2. A higher security risk coefficient indicates a greater security risk to the database posed by the corresponding SQL operation. Quantifying the security risk of SQL operations using the security risk coefficient provides a more intuitive reflection of the security risks associated with each operation.

[0031] User identifiers are used to indicate the client that triggered the SQL operation. For example, a user identifier can be represented by a database login account. User identifiers allow for precise identification of the client that triggered the SQL operation, facilitating the determination and tracing of intrusion behavior.

[0032] IP addresses are used to locate the source of SQL operations. For example, an IP address can be the client's IP address, which facilitates the identification and tracing of intrusion behavior.

[0033] In some implementations, electronic devices extract SQL operation logs from database logs. Database logs record various behavioral data during database operation. For example, database logs record data related to database kernel operation, data read / write, transaction execution, and other behaviors, forming the data foundation for database intrusion detection. Database logs can be binary logs. Electronic devices perform data cleaning on the database logs to filter out non-SQL operation records, obtaining the SQL operation logs.

[0034] For example, an electronic device collects database logs through a native database log interface. First, the electronic device filters the collected database logs, removing non-SQL operation records. That is, redundant records unrelated to SQL operations are removed from the database logs, resulting in a filtered database log. By filtering the database logs and retaining only SQL operation records, the amount of data processing can be reduced, and the efficiency of obtaining SQL operation logs can be improved.

[0035] After filtering the database logs, the electronic device fills in any missing fields to complete the log records. By filling in missing resources in the database logs, the integrity of each SQL operation record is ensured, improving the accuracy and reliability of intrusion detection.

[0036] For example, taking the first log record (any log record) in the database log as an example, if the first log record is missing a timestamp field, the electronic device can supplement the timestamp field of the first log record based on the timestamps of adjacent log records. For example, the timestamp of the first log record can be determined by interpolating the timestamps of adjacent log records, and the timestamp can be supplemented into the timestamp field of the first log record.

[0037] For example, if a security risk coefficient field is not present in the log records, the electronic device determines the operation category of the SQL operation based on the keywords of the SQL statement in the log records, and then adds a security risk coefficient field to each SQL operation record based on the security risk coefficient corresponding to the operation category of the SQL operation.

[0038] After populating the database logs, the electronic device standardizes the populated logs to obtain the final SQL operation logs. During standardization, the electronic device unifies the format of each field in multiple SQL operation records within the database logs. For example, for the operation type field, the electronic device standardizes it to lowercase characters and a standard name. Taking a delete operation as an example, if the operation type field in a delete operation record is "DELETE FROM", the electronic device changes this field to "delete". Similarly, for the timestamp field, the electronic device converts the timestamp field to a preset timestamp format, such as "year-month-day-hour-minute-second". By standardizing the format of each field in the SQL operation records, the device eliminates recognition errors caused by different formats of the same field content, improving the accuracy of intrusion detection.

[0039] In this embodiment of the application, by filtering, filling and standardizing the database logs, the SQL log records are effectively extracted, thereby reducing the redundancy of log records and the differences in data format, and providing an accurate data foundation for the identification of intrusion behavior.

[0040] To achieve chronological ordering of SQL operation records in the SQL operation log, some implementations use the timestamp of each SQL log record to organize the SQL operation log into an ordered SQL operation log arranged chronologically. By organizing the SQL operation log into an ordered SQL operation log, the chronological sequence of SQL operations occurring in the database within a continuous time period can be reflected, providing an ordered SQL operation log for subsequent encoding into a time-series image.

[0041] For example, an electronic device sets a preset time interval window, and stores SQL operation records through the time window corresponding to each preset time interval, thereby dividing the SQL operation records and obtaining the SQL operation log corresponding to each time window. In practical applications, the preset time interval can be set according to the actual application scenario. For example, the preset time interval can be set to a value such as 30 seconds, 60 seconds, or 120 seconds.

[0042] The timestamps of SQL operation records within the same time window correspond to the time period (the length of the time period is equal to the preset time interval). For multiple SQL operation records divided into the same time window, the electronic device sorts the multiple SQL operation records in chronological order to obtain an ordered SQL operation log.

[0043] In practical applications, electronic devices can also configure a unique log identifier for the SQL operation logs corresponding to each time window. For example, a log identifier for the SQL operation logs corresponding to each time window can be generated by a combination of the log segment sequence number (i.e., LogSegment) and the time (year, month, day, hour, minute (i.e., YYYYMMDD_HHMM)). For example, LogSegment_YYYYMMDD_HHMM can be used to identify and differentiate the SQL operation logs corresponding to each time window.

[0044] In some examples, multiple SQL operation records within the same time window may conflict, such as in scenarios where concurrent transactions update SQL log records in a database, where multiple SQL operation records have the same timestamp. In such cases, when an electronic device sorts multiple SQL operation records within the same time window, it can prioritize the SQL operation records with conflicting timestamps according to a preset priority. This ensures an ordered arrangement of SQL operation records within the same time window and reduces the probability of disordered order due to conflicts. The preset priority can be set according to the actual application scenario or requirements.

[0045] In one example, the preset priority could be a preset order of SQL operation types. For instance, the preset order of SQL operation types could be: destroy, delete, update, query, and insert. Taking two SQL operation records with timestamp conflicts as an example, one record being a destroy operation and the other a query operation, the electronic device would arrange the destroy operation record before the query operation record.

[0046] In another example, the preset priority can be the user permission level. The higher the user permission level corresponding to a SQL operation record, the higher the sorting of that SQL operation record. For example, taking SQL operation records 1 and 2 with the same timestamp, if the user permission corresponding to SQL operation record 1 is higher than that corresponding to SQL operation record 2, the electronic device will sort SQL operation record 1 before SQL operation record 2.

[0047] To mitigate the impact of log collection on database performance in high-concurrency scenarios, some implementations incorporate a message queue for caching database logs (i.e., raw logs) on electronic devices. The electronic device caches the database logs in the message queue and retrieves SQL operation logs by reading the cached database logs from the message queue. This asynchronous buffering of database logs via the added message queue allows for the retrieval of SQL operation logs without blocking the main database thread or business threads, thus reducing the performance overhead of direct log collection.

[0048] In some implementations, electronic devices can also acquire only newly added database logs by listening or changing the data capture method, that is, by collecting database logs incrementally, thereby reducing the repeated collection of database logs and reducing the overhead of repeated collection and parsing of database logs.

[0049] In step 102 above, the electronic device encodes the SQL operation logs to obtain a time-series image. For example, the electronic device encodes the SQL operation logs corresponding to each time window into a time-series image in chronological order.

[0050] A time-series image is a two-dimensional image. It comprises features in two distinct dimensions: a first-dimensional feature and a second-dimensional feature. The first-dimensional feature corresponds to the time dimension of the SQL operation log. The second-dimensional feature corresponds to the SQL operation type within the SQL operation log. During the encoding process, the electronic device utilizes preset encoding rules to map the time sequence of the SQL operation log to the first-dimensional feature and the SQL operation type to the second-dimensional feature. Under the influence of these two features, the SQL operation log is encoded to obtain the time-series image.

[0051] By encoding SQL operation logs into time-series images, the intrusion detection problem targeting SQL operation logs can be transformed into a target recognition problem based on time-series images, thereby reducing the difficulty of intrusion detection and enabling efficient and accurate location of intrusion behaviors.

[0052] In some implementations, the electronic device can encode the SQL operation log into a time-series image based on the operation attributes of the SQL operation log. For example, the electronic device can map the operation attributes of the SQL operation log to the color features of the time-series image.

[0053] The operation attributes of SQL operation logs include security risk coefficient, operation frequency, and IP address. Operation frequency refers to the number of times a corresponding SQL operation of the same type occurs within a unit of time (e.g., 1 second). For example, taking a query operation as an example, an electronic device can count the number of times a query operation occurred within 1 second prior to any given moment. If this number is 2, then the operation frequency of the query operation at that moment is determined to be 2.

[0054] In some implementations, the electronic device can directly obtain operation attributes from the SQL operation records. For example, if the SQL operation records include operation data such as security risk coefficients and IP addresses, the electronic device can directly obtain the security risk coefficients and IP addresses. In other implementations, the electronic device determines operation attributes based on the SQL operation records. For example, regarding operation frequency, the electronic device calculates the operation frequency corresponding to each type of SQL operation based on the operation data in the SQL operation records.

[0055] The color features of a time-series image include three color channels: a first color channel, a second color channel, and a third color channel. Each color channel corresponds to an operational attribute. For example, the first color channel corresponds to a security risk coefficient, the second color channel corresponds to operational frequency, and the third color channel corresponds to an IP address.

[0056] The following application example illustrates the process of encoding SQL operation logs into time-series images. In this example, the first dimension feature is the x-axis (e.g., horizontal axis) of the time-series image, and the second dimension feature is the y-axis (e.g., vertical axis). The electronic device maps the SQL operation logs for each time window into a time-series image.

[0057] Table 1 illustrates the mapping method between the SQL operation log's operation attributes and the time series image attributes. As shown in Table 1, each pixel coordinate on the x-axis of the time series image corresponds to 1 second. Taking a 60-second time window as an example, the SQL operation log corresponds to 60 pixel coordinates on the x-axis of the time series image. Each pixel coordinate on the y-axis of the time series image corresponds to one operation type. Taking five operation types as an example, the select operation corresponds to y-axis coordinate 0, the update operation corresponds to y-axis coordinate 1, the insert operation corresponds to y-axis coordinate 2, the delete operation corresponds to y-axis coordinate 3, and the destroy operation corresponds to y-axis coordinate 4.

[0058] Accordingly, taking the first color channel of the time series image as the red (R) channel, the second color channel as the green (G) channel, and the third color channel as the blue (B) channel as an example, for the red channel, the electronic device maps the security risk coefficient of the SQL operation log to the red channel value of the time series image (R is between 0 and 255). For example, the security risk coefficient 3 is mapped to the red channel value R=255, and the security risk coefficient 1 is mapped to the red channel value R=85. For the green channel, the electronic device maps the operation frequency of the SQL operation log to the green channel value of the time series image (G is between 0 and 255). For the blue channel, the electronic device maps the IP address of the SQL operation log to the blue channel value of the time series image (B is between 0 and 255). For example, the lower 8 bits of the hash value of the IP address are mapped to the blue channel value between 0 and 255.

[0059] Table 1. Mapping method of SQL operation log operation attributes to time series image attributes.

[0060] To enhance database security, some implementations involve electronic devices periodically (e.g., every 24 hours) changing the encoding rules for the color features of time-series images. By altering these encoding rules, the likelihood of attackers cracking the encoding of the time-series images and thus simulating intrusion attempts is reduced, thereby strengthening database security.

[0061] In some implementations, electronic devices can also incorporate image fingerprints into the generated time-series images. For example, the electronic device embeds a hash-based message authentication code (HMAC) at the edge of each time-series image. Before performing target detection on the time-series image, the electronic device can extract the HMAC from the image and compare it with a local checksum. If the HMAC matches the local checksum, the time-series image is considered tamper-proof and is input into the target detection model. If the HMAC does not match the local checksum, the time-series image is considered tamper-proof and is discarded. This method enables the verification of the integrity and security of the time-series image, improving the accuracy of intrusion detection.

[0062] After encoding the SQL operation log into a time-series image, in step 103, the electronic device inputs the time-series image into a target detection model used to detect intrusion behavior, and obtains the detection results output by the target detection model. In some implementations, the detection results include one or more of the following: image coordinates corresponding to the intrusion behavior, SQL operation type, confidence level, and time continuity score. The time continuity score is used to assess the duration of the intrusion behavior.

[0063] In this embodiment, the target detection model can be a neural network model for target detection. For example, the target detection model is a neural network model improved based on the YOLO series of models. In some examples, the target detection model can also use multi-scale target detection networks such as Single Shot MultiBox Detector (SSD) and RetinaNet to detect intrusion behavior based on time-series images.

[0064] In some implementations, the object detection model includes an input layer, a backbone network, a neck network, and a head network. The input layer maps the temporal image to a preset size; the backbone network extracts image features from the temporal image; the neck network performs feature fusion on the extracted image features, and includes a Feature Pyramid Network (FPN) with a temporal attention mechanism. This allows for feature fusion of feature maps at different scales through the FPN and temporal enhancement of the feature maps over time through the temporal attention mechanism; the head network outputs the detection results.

[0065] The electronic device inputs a time-series image into the input layer of the target detection model. The input layer maps the time-series image to a preset size. Then, the time-series image of the preset size is input into the backbone network. The backbone network extracts the image features of the time-series image to obtain the first feature map of the time-series image. The first feature map is then input into the neck network to obtain the second feature map. Finally, the second feature map is input into the head network to obtain the detection result.

[0066] For example, taking a neural network model based on YOLO12 as an example, the object detection model provided in this application is introduced. To adapt to the temporal features (i.e., the first dimension features) of temporal images, a temporal dimension normalization module is added to the input layer of the object detection network. The temporal dimension normalization model is used to map the input temporal image to a preset size. The input layer maps the temporal image to a preset size (e.g., 640×640) through the temporal dimension normalization module, thereby eliminating temporal feature distortion caused by differences in the size of different input images.

[0067] The backbone network of the object detection network adopts the YOLO12 CSPDarknet53 structure. To enhance the feature extraction capability of large-area intrusion regions (i.e., the image regions corresponding to intrusion behaviors), the kernel size of the convolutional layers 3 to 5 of the backbone network is increased, adjusting the kernel size from 3×3 to 5×5. The backbone network extracts features from temporal images of a preset size through multiple convolutional layers, obtaining multi-scale first feature maps.

[0068] The neck network of the object detection model fuses multi-scale first feature maps to obtain a second feature map. To improve the detection capability of persistent intrusion behavior, the neck network of the object detection model introduces a temporal attention mechanism into the Feature Processing Network (FPN). For example, the neck network samples the multi-scale first feature maps separately through multiple sampling layers of the FPN. After each sampling layer of the FPN, an independent temporal attention submodule is added to perform temporal attention processing on the feature maps output by the sampling layers. Then, the FPN fuses the multiple feature maps after temporal attention processing to obtain the second feature map. By introducing a temporal attention mechanism into the FPN, it is possible to both capture single high-risk short-term intrusion behavior through the FPN, reducing the false negative rate of short-term intrusion behavior, and improve the detection capability of persistent intrusion behavior.

[0069] In addition to outputting the image coordinates, risk category, and confidence score corresponding to the intrusion behavior, the output layer of the head network also outputs a temporal continuity score for the intrusion behavior. The image coordinates are the image coordinates of the image region corresponding to the intrusion behavior. The risk category indicates the level of security risk associated with the intrusion behavior. For example, risk categories include high-risk, medium-risk, and low-risk operations. The confidence score indicates the degree of belief that the SQL operation is an intrusion behavior; the confidence score is between 0 and 1, with a higher confidence score indicating a greater probability that the SQL operation is an intrusion behavior.

[0070] The time continuity score is used to assess the duration of an intrusion, distinguishing between accidental SQL operations and malicious, continuous SQL operations. The time continuity score is positively correlated with the duration of the intrusion; a higher score indicates a longer duration. The time continuity score can range from 0 to 1. For example, if the duration of the intrusion is greater than or equal to 3 seconds, the time continuity score is 1. If the duration of the intrusion is less than 1 second, the time continuity score is less than or equal to 0.3.

[0071] In one example, taking the intrusion behavior as a continuous DROP operation as an example, the detection results output by the head network include: image coordinates (x1=10, y1=4, x2=15, y2=4), indicating the DROP operation from the 10th to the 15th second; risk category as high-risk operation (such as multiple consecutive DROP operations); confidence level of 0.91; and temporal continuity score of 1.

[0072] In some implementations, during the process of target detection in a time-series image by an electronic device using a target detection model, the target detection model can also mark the image regions corresponding to intrusion behaviors of different durations on the time-series image using detection boxes (or anchor boxes) of different sizes. For example, the target detection model is configured with detection boxes of different sizes. For instance, based on historical operation logs, the electronic device statistically determines that the pixel distribution range corresponding to the intrusion behavior is concentrated between (10×5) and (30×20), meaning the duration of the intrusion behavior is between 5 and 30 seconds. Based on this, the electronic device configures three sizes of detection boxes for the target detection model to cover the image regions corresponding to the intrusion behavior. These three sizes are (12×6), (20×10), and (28×18). In this way, the detection boxes of the target detection model can better adapt to attack behaviors of different durations, improving the detection performance of the target detection model. Compared with a general detection box, the detection efficiency can be improved by 30%.

[0073] The aforementioned object detection network was trained under supervised supervision using training samples from the training set. The electronic device used to train the object detection network and the electronic device used for intrusion detection can be the same electronic device or different electronic devices. Here, we will uniformly describe the training process of the object detection network using the electronic device as the executing entity.

[0074] First, electronic devices build a training set adapted for database intrusion detection scenarios.

[0075] Electronic devices collect historical operation logs during database operation, encode these logs into sample images, and assign a sample label to each image, forming multiple sets of samples with corresponding image and label information. For example, electronic devices can use annotation tools such as LabelImg to label the sample images (e.g., marking image regions corresponding to intrusion behaviors), obtaining a sample label for each image. The sample label includes the image coordinates, risk category, confidence level, and time continuity score corresponding to the intrusion behavior. The multiple sets of samples include positive and negative samples. Positive samples represent samples containing intrusion behaviors such as destruction operations and high-frequency update operations. Negative samples represent samples containing non-intrusion behaviors.

[0076] Here, the process of electronic devices encoding historical operation logs into sample images can be found in the process of encoding SQL operation logs into time-series images, which will not be repeated here.

[0077] To enhance the generalization ability of object detection models, electronic devices can perform data augmentation on sample images in some implementations. For example, while preserving the temporal continuity of sample images (i.e., the temporal characteristics of the x-axis), electronic devices can randomly crop the sample images to enrich the data samples. Another example is that electronic devices can simulate sample images corresponding to log distributions under different business scenarios through color dithering. Yet another example is that electronic devices can add Gaussian noise to sample images to improve the object detection model's resistance to noise interference and enhance the robustness of intrusion detection. In some implementations, electronic devices can also encode obfuscated SQL operation logs into sample images, enabling the object detection model to learn unknown attack characteristics and improve its generalization ability to novel intrusion behaviors.

[0078] After obtaining multiple sets of samples, the electronic device divides these samples into training and validation sets. In the training and testing sets, the ratio between non-intrusive behavior samples and intrusive behavior samples is a preset ratio (e.g., 3:1).

[0079] Then, the electronic device trains the target detection model based on multiple sets of samples in the training set.

[0080] The electronic device was trained on YOLOv12 using the COCO dataset. The kernel size of layers 3 to 5 of the backbone network was adjusted (from 3×3 to 5×5), and a temporal attention network was added to the neck network. A transfer learning strategy was employed during training: the network parameters of the first two convolutional layers of the backbone network were frozen to reuse general image low-level texture extraction capabilities and reduce the risk of overfitting. Only the network parameters of the convolutional layers after layer 3 of the backbone network, the feature pyramid network, the temporal attention network, and the head network were fine-tuned.

[0081] The electronic device inputs sample images from each group of samples in the training set into the object detection model to obtain the output results. Then, based on the output results and corresponding sample labels (e.g., comparing the output results with the sample labels), the electronic device calculates the model loss. Then, based on the model loss, the electronic device optimizes the network parameters (such as weight parameters, bias parameters, etc.) of the object detection model, completing one round of iterative optimization. After several rounds of iterative optimization, such as after every 100 rounds, the electronic device validates the object detection model using a validation set and calculates the performance evaluation metrics. For example, performance evaluation metrics include one or more evaluation parameters such as false negative rate, precision, recall, and F1 score. The F1 score is the harmonic mean of precision and recall.

[0082] Taking the F1 score as a performance evaluation metric, if the F1 score of the object detection model decreases in three consecutive validations, the electronic device automatically adjusts the learning rate, such as continuously reducing the learning rate from 0.001 to 0.0001. When the F1 score of the object detection model on the test set is greater than a preset threshold (e.g., 0.92) multiple times consecutively, the object detection model is considered to have converged, and the training of the object detection model is complete, resulting in a trained object detection model.

[0083] In some implementations, the model loss of the object detection model includes localization loss, classification loss, and temporal continuity loss. Localization loss measures the deviation between the image coordinates corresponding to the intrusion behavior predicted by the object detection model (i.e., the image coordinates of the output result) and the image coordinates of the sample label. Localization loss can be calculated using the intersection-over-union loss function or other loss functions. Classification loss measures the deviation between the risk category corresponding to the intrusion behavior predicted by the object detection model (i.e., the risk category of the output result) and the risk category of the sample label. Classification loss can be calculated using the cross-entropy loss function or other loss functions. Temporal continuity loss measures the deviation between the temporal continuity score corresponding to the intrusion behavior predicted by the object detection model (i.e., the temporal continuity score of the output result) and the temporal continuity score of the sample label. Temporal continuity loss can be calculated using the L1 loss function or other loss functions.

[0084] For example, the formula for calculating the model loss of the object detection model is shown in formula (1): Formula (1) in, This represents the model loss of the object detection model. Indicates positioning loss; Indicates classification loss; This indicates a loss of temporal continuity.

[0085] Understandably, the loss weights for localization loss, classification loss, and temporal continuity loss in the model loss calculation formula for object detection models can be set according to actual application scenarios or requirements. In the example above, when the temporal continuity score (x-axis span) predicted by the object detection model matches the sample label, the model loss of the object detection model is reduced by 20%, thereby improving the detection accuracy of the object detection model against continuous attack behaviors.

[0086] After using a trained object detection model to detect intrusion behavior on time-series images and obtaining the inspection results, the electronic device can determine whether intrusion behavior exists based on the confidence level of the detection results. If the confidence level is less than or equal to a first preset value (e.g., 0.2), it is considered that no intrusion behavior exists. If the confidence level is greater than the first preset value, it is considered that intrusion behavior exists. The object detection model can obtain detection results corresponding to one or more intrusion behaviors.

[0087] In step 104 above, if the detection result indicates the presence of an intrusion, the electronic device assesses the security risk of the intrusion based on the detection result, thus obtaining the risk response level of the intrusion. For example, the electronic device determines the risk response level of the intrusion based on one or more of the confidence level, risk category, and time continuity score of the inspection result. The risk response level is positively correlated with the security risk corresponding to the intrusion; the higher the security risk corresponding to the intrusion, the higher the risk response level.

[0088] In one example, for any intrusion behavior, if the confidence level corresponding to the intrusion behavior is greater than a first preset value and less than or equal to a second preset value (e.g., 0.6), then the risk response level of the intrusion behavior is determined to be the first response level (e.g., low response). If the confidence level corresponding to the intrusion behavior is greater than the second preset value and less than or equal to a third preset value (e.g., 0.8), then the risk response level of the intrusion behavior is determined to be the second response level (e.g., medium response). If the confidence level corresponding to the intrusion behavior is greater than the third preset value, then the risk response level of the intrusion behavior is determined to be the third response level (i.e., high response). The risk response levels corresponding to the first, second, and third response levels increase sequentially.

[0089] In another example, for any intrusion behavior, if the confidence level and time continuity score corresponding to the intrusion behavior meet any of the following low-risk response conditions, then the risk response level of the intrusion behavior is confirmed as the first response level: 1) The confidence level is greater than the third preset value, and the time continuity score is less than or equal to the first scoring threshold (e.g., 0.3). For example, the confidence level is greater than 0.8, and the time continuity score is less than or equal to 0.3. 2) The confidence level is greater than the second preset value and less than or equal to the third preset value, and the time continuity score is greater than the first score threshold and less than or equal to the second score threshold (e.g., 0.7), such as 0.6 < confidence level ≤ 0.8, and 0.3 < time continuity score ≤ 0.7; 3) The confidence level is greater than the third preset value and less than or equal to the second preset value, and the time continuity score is greater than the second score threshold, such as 0.2 < confidence level ≤ 0.6 and time continuity score > 0.7.

[0090] If the confidence level and time continuity score corresponding to the intrusion behavior meet any of the following medium-risk response conditions, then the risk response level of the intrusion behavior is confirmed as Level 2: 1) The confidence level is greater than the third preset value, and the time continuity score is greater than the first scoring threshold and less than or equal to the second scoring threshold, such as confidence level > 0.8 and 0.3 < time continuity score ≤ 0.7; 2) The confidence level is greater than the second preset value and less than or equal to the third preset value, and the time continuity score is greater than the second score threshold, such as 0.6 < confidence level ≤ 0.8 and time continuity score > 0.7.

[0091] If the confidence level and time continuity score corresponding to the intrusion behavior meet the high-risk response criteria, then the risk response level of the intrusion behavior is confirmed as the third response level. The high-risk response criteria are: the confidence level is greater than the third preset value, and the time continuity score is greater than the second score threshold, such as confidence level > 0.8 and time continuity score > 0.7.

[0092] After determining the risk response level corresponding to the intrusion behavior, in step 105 above, the electronic device executes the interception operation corresponding to the risk response level. For example, the electronic device executes the interception operation corresponding to the risk response level for the intrusion behavior through a kernel extension module, thereby intercepting the intrusion behavior through a kernel-level interception mechanism when the intrusion behavior is detected.

[0093] When the risk response level is at the highest level, the electronic device generates a warning message about the intrusion behavior through a kernel extension module. This warning message alerts the user to the low-risk operation on the database. The warning message also includes the detection results of the intrusion behavior and the corresponding SQL log records, allowing the user to obtain detailed information about the intrusion.

[0094] When the risk response level is low (i.e., first response level), in addition to generating warning messages about intrusion behavior, electronic devices can also perform query rewriting operations in response to the intrusion behavior. That is, the SQL operation statement corresponding to the intrusion behavior is converted into an SQL operation statement with security filtering, thereby blocking the intrusion behavior. The interception operation process corresponding to the low-level response can be controlled within 100ms, so as to promptly intercept low-risk intrusion behaviors.

[0095] When the risk response level is medium (i.e., level two), the electronic device executes a rollback operation on the transaction corresponding to the intrusion behavior through a kernel extension module, thereby forcing the transaction to be rolled back to an uncommitted state. The electronic device can also isolate and manage the session corresponding to the intrusion behavior to restrict the session from continuously initiating suspicious SQL operation requests. Simultaneously, isolation and management can also physically isolate the session traffic corresponding to the intrusion behavior from normal business traffic, reducing the pollution of normal business data by malicious statements. The interception process for a medium-risk response can be controlled within 20ms, thus enabling timely interception of intrusion behaviors involving medium-risk operations.

[0096] When the risk response level is high (i.e., level 3), the electronic device terminates the session corresponding to the intrusion behavior through a kernel extension module, thereby directly cutting off the channel for sending high-risk operation requests and reducing the destructive impact of the intrusion behavior on the database. The electronic device can also simultaneously implement temporary access control on the IP address of the intrusion behavior, thereby preventing the same attack source from repeatedly establishing new sessions to launch continuous intrusions against the database. The interception process corresponding to high-level response can be controlled within 5ms, thus enabling timely interception of high-risk intrusion behaviors.

[0097] During the process of intercepting intrusions, electronic devices can also simultaneously record information related to the intrusions, such as the detection results of the intrusions, related SQL log records, session data, and other information related to the intrusions, so as to completely preserve the digital forensic records related to the intrusions and facilitate security tracing.

[0098] To enhance intrusion detection security, some implementations allow electronic devices to continuously track and detect SQL operation logs of the same session (i.e., state tracking), thereby enabling the detection of continuous contexts within the same session and reducing the false negative rate of intrusion behavior.

[0099] To improve intrusion detection efficiency, some implementations may configure whitelists within electronic devices. These whitelists can record trusted IP addresses, authorized accounts, etc. For example, if SQL operation logs originate from trusted IP addresses, the electronic device can bypass the intrusion detection process, quickly allowing whitelisted operations to proceed, reducing computational overhead from trusted business traffic and lowering business response latency. To enhance whitelist security, some implementations may also include protection mechanisms. For instance, the electronic device can store the whitelist using encryption. When a modification request to the whitelist is detected, a real-time auditing module verifies the modification permissions, minimizing the possibility of malicious tampering or abuse of the whitelist.

[0100] The intrusion detection method provided in this application embodiment will be further illustrated by an application example below. The framework of the intrusion detection method provided in this application example is as follows: Figure 2 As shown in the example, the electronic device includes a log processing module, a detection module, and a response module.

[0101] The log processing module collects database logs and generates time-series images based on them. First, the module collects and parses the raw logs (i.e., database logs). Then, it cleans the raw logs and divides them into time windows, removing invalid and redundant logs. It then segments the database logs using preset time intervals to obtain the SQL operation logs for each time window. Finally, the module encodes the SQL operation logs into time-series images according to preset encoding rules.

[0102] The detection module sequentially processes the training data annotation and model training and optimization to obtain a trained target detection model, and then uses the target detection model to perform real-time inference on the time-series images to obtain the inspection results of the time-series images.

[0103] The response module determines the risk response level of intrusion behavior based on the detection results output by the target detection model and intercepts the intrusion behavior through a kernel-level interception mechanism. During the interception process, the response module executes a multi-level response strategy: a high-level response (session termination + temporary IP address blocking) for high-risk operations, a medium-level response (transaction rollback + session isolation) for medium-risk operations, and a low-level response (query rewrite + audit alerts) for low-risk operations. In addition, the response module provides enhanced security mechanisms, such as periodically updating the encoding rules of color features, tracking the context state of the same session, and auditing the whitelist, thereby comprehensively improving the security of the database.

[0104] The method provided in this application has at least the following beneficial effects: Log visualization and time-series image encoding: Breaking through the limitations of traditional text log analysis, this method transforms SQL statement log records into two-dimensional visual time-series images using time windows. The vertical axis represents the operation type, and the horizontal axis represents the timestamp. Compared to text logs, this visualization encoding method can intuitively present the spatiotemporal distribution characteristics of attack behavior. For example, high-risk operations are highlighted in the time-series image, significantly improving the efficiency and accuracy of intrusion behavior identification.

[0105] Target detection model adaptation: An improved target detection algorithm based on YOLOv12 is adopted, and deep learning is performed on the image features of intrusion behaviors in time-series images for training. Compared with traditional machine learning models (such as random forests), this target detection algorithm has stronger feature abstraction capabilities, can automatically identify image features of new attack behaviors such as modified SQL injection, and does not require frequent reliance on manually labeled samples for algorithm updates, significantly enhancing its generalization ability to unknown attack behaviors.

[0106] Database kernel-level blocking mechanism: A kernel-level blocking system is built for the database. Upon detecting intrusion, it directly triggers low-level interception operations such as session termination and transaction rollback. Compared to the traditional "alarm-manual handling" response process, the response speed is significantly improved, jumping from minutes to milliseconds, achieving instant interception of attacks and minimizing the risk of data leakage and system damage.

[0107] To implement the intrusion detection method provided in the embodiments of this application, the embodiments of this application also provide an intrusion detection device, such as... Figure 3 As shown, the device includes: Log processing module 31 is used to obtain SQL operation logs from the database; The log processing module 31 is further configured to encode the SQL operation log into a time-series image, wherein the first dimension feature of the time-series image corresponds to the time sequence of the SQL operation log, and the second dimension feature of the time-series image corresponds to the SQL operation type of the SQL operation log. The detection module 32 is used to input the time-series image into the target detection model and obtain the detection result output by the target detection model, wherein the target detection model is used to detect intrusion behavior; Response module 33 is used to assess the security risk of the intrusion behavior and obtain the risk response level of the intrusion behavior when the detection result indicates that there is an intrusion behavior; The response module 33 is also used to perform the interception operation corresponding to the risk response level.

[0108] In some optional implementations, the log processing module 31 is specifically used for: Based on the operation attributes of the SQL operation log, the SQL operation log is encoded into a time-series image; wherein, the operation attributes include a security risk coefficient, operation frequency, and IP address; the time-series image includes a first color channel, a second color channel, and a third color channel, wherein the first color channel corresponds to the security risk coefficient, the second color channel corresponds to the operation frequency, and the third color channel corresponds to the IP address.

[0109] In some optional implementations, the log processing module 31 is specifically used for: Retrieve database logs; Filter out non-SQL operation records from the database log to obtain the filtered database log; The missing fields in the filtered database logs are filled to obtain the filled database logs. The database logs after the filling process are standardized to obtain the SQL operation logs.

[0110] In some optional implementations, the target detection model includes an input layer, a backbone network, a neck network, and a head network; the detection module 32 is specifically used for: The time series image is input into the input layer, and the input layer is used to map the time series image to a preset size; The time-series image of the preset size is input into the backbone network, and the image features of the time-series image are extracted using the backbone network to obtain the first feature map of the time-series image; The first feature map is input into the neck network to obtain a second feature map; wherein, the neck network includes a feature pyramid network with a temporal attention mechanism; The second feature map is input into the head network to obtain the detection result, wherein the detection result includes the image coordinates, risk category, confidence level and temporal continuity score corresponding to the intrusion behavior, and the temporal continuity score is used to evaluate the duration of the intrusion behavior.

[0111] In some alternative implementations, the detection module 32 is further configured to: Obtain a training set, wherein the training set includes multiple sample images and sample labels corresponding to each sample image, and the sample images are obtained by encoding the historical operation logs of the database; Each sample image in the training set is input into the target detection model to obtain the output result of the target detection model; Based on the output results and the corresponding sample labels, the model loss is calculated; wherein, the model loss includes localization loss, classification loss and temporal continuity loss, the localization loss is used to measure the deviation between the image coordinates of the output results and the image coordinates of the sample labels, the classification loss is used to measure the deviation between the risk category of the output results and the risk category of the sample labels, and the temporal continuity loss is used to measure the deviation between the temporal continuity score of the output results and the temporal continuity score of the sample labels. The network parameters of the target detection model are adjusted based on the model loss to obtain an optimized target detection model; After multiple rounds of optimization, the trained target detection model was obtained.

[0112] In some alternative implementations, the response module 33 is specifically used for: If the risk response level is the first response level, a warning message for the intrusion behavior is generated; If the risk response level is the second response level, a rollback operation will be performed on the transaction corresponding to the intrusion behavior; If the risk response level is level three, the session corresponding to the intrusion behavior will be terminated. The risk response levels corresponding to the first response level, the second response level, and the third response level increase sequentially.

[0113] In some alternative implementations, the detection module 32 is further configured to: On the time-series image, image regions corresponding to intrusion behaviors of different durations are marked by detection boxes of different sizes.

[0114] In practical applications, the log processing module 31, the detection module 32, and the response module 33 can be implemented by the processor in the intrusion detection device.

[0115] It should be noted that the intrusion detection device provided in the above embodiments is only illustrated by the division of the above-described program units. In practical applications, the above processing can be assigned to different program units as needed, that is, the internal structure of the device can be divided into different program units to complete all or part of the processing described above. In addition, the intrusion detection device and the intrusion detection method embodiments provided in the above embodiments belong to the same concept, and their specific implementation process can be found in the method embodiments, which will not be repeated here.

[0116] Based on the hardware implementation of the above program modules, and in order to implement the method of the embodiments of this application, the embodiments of this application also provide an electronic device, such as... Figure 4 As shown, the electronic device includes: The communication interface 401 enables information exchange with other electronic devices (such as terminal devices); The processor 402 is connected to the communication interface 401 to enable information interaction with other electronic devices (such as terminal devices) and to execute the methods provided by one or more of the above-mentioned technical solutions when running computer programs; The computer program is stored in memory 403.

[0117] Specifically, the processor 402 is used for: Retrieve the SQL operation logs from the database; The SQL operation log is encoded into a time-series image, wherein the first dimension feature of the time-series image corresponds to the time sequence of the SQL operation log, and the second dimension feature of the time-series image corresponds to the SQL operation type of the SQL operation log; The time-series image is input into the target detection model to obtain the detection result output by the target detection model, wherein the target detection model is used to detect intrusion behavior; If the detection result indicates the presence of intrusion, the security risk of the intrusion is assessed to obtain the risk response level of the intrusion. Perform the interception operation corresponding to the risk response level.

[0118] In some alternative implementations, the processor 402 is specifically used for: Based on the operation attributes of the SQL operation log, the SQL operation log is encoded into a time-series image; wherein, the operation attributes include a security risk coefficient, operation frequency, and IP address; the time-series image includes a first color channel, a second color channel, and a third color channel, wherein the first color channel corresponds to the security risk coefficient, the second color channel corresponds to the operation frequency, and the third color channel corresponds to the IP address.

[0119] In some alternative implementations, the processor 402 is specifically used for: Retrieve database logs; Filter out non-SQL operation records from the database log to obtain the filtered database log; The missing fields in the filtered database logs are filled to obtain the filled database logs. The database logs after the filling process are standardized to obtain the SQL operation logs.

[0120] In some optional implementations, the target detection model includes an input layer, a backbone network, a neck network, and a head network; the processor 402 is specifically used for: The time series image is input into the input layer, and the input layer is used to map the time series image to a preset size; The time-series image of the preset size is input into the backbone network, and the image features of the time-series image are extracted using the backbone network to obtain the first feature map of the time-series image; The first feature map is input into the neck network to obtain a second feature map; wherein, the neck network includes a feature pyramid network with a temporal attention mechanism; The second feature map is input into the head network to obtain the detection result, wherein the detection result includes the image coordinates, risk category, confidence level and temporal continuity score corresponding to the intrusion behavior, and the temporal continuity score is used to evaluate the duration of the intrusion behavior.

[0121] In some alternative implementations, the processor 402 is further configured to: Obtain a training set, wherein the training set includes multiple sample images and sample labels corresponding to each sample image, and the sample images are obtained by encoding the historical operation logs of the database; Each sample image in the training set is input into the target detection model to obtain the output result of the target detection model; Based on the output results and the corresponding sample labels, the model loss is calculated; wherein, the model loss includes localization loss, classification loss and temporal continuity loss, the localization loss is used to measure the deviation between the image coordinates of the output results and the image coordinates of the sample labels, the classification loss is used to measure the deviation between the risk category of the output results and the risk category of the sample labels, and the temporal continuity loss is used to measure the deviation between the temporal continuity score of the output results and the temporal continuity score of the sample labels. The network parameters of the target detection model are adjusted based on the model loss to obtain an optimized target detection model; After multiple rounds of optimization, the trained target detection model was obtained.

[0122] In some alternative implementations, the processor 402 is specifically used for: If the risk response level is the first response level, a warning message for the intrusion behavior is generated; If the risk response level is the second response level, a rollback operation will be performed on the transaction corresponding to the intrusion behavior; If the risk response level is level three, the session corresponding to the intrusion behavior will be terminated. The risk response levels corresponding to the first response level, the second response level, and the third response level increase sequentially.

[0123] In some alternative implementations, the processor 402 is further configured to: On the time-series image, image regions corresponding to intrusion behaviors of different durations are marked by detection boxes of different sizes.

[0124] It should be noted that the specific processing procedures of the processor 402 and the communication interface 401 can be understood by referring to the above method.

[0125] Of course, in practical applications, the various components in an electronic device are coupled together through a bus system 404. It can be understood that the bus system 404 is used to realize the connection and communication between these components. In addition to a data bus, the bus system 404 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, in... Figure 4 The general designated all buses as Bus System 404.

[0126] The memory 403 in this embodiment is used to store various types of data to support the operation of the electronic device. Examples of such data include any computer program used to operate on the electronic device.

[0127] The methods disclosed in the embodiments of this application can be applied to the processor 402, or implemented by the processor 402. The processor 402 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the integrated logic circuit of the hardware in the processor 402 or by instructions in the form of software. The processor 402 may be a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The processor 402 can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of this application can be directly reflected as being executed by a hardware decoding processor, or being executed by a combination of hardware and software modules in the decoding processor. The software modules may be located in a storage medium, which is located in the memory 403. The processor 402 reads the information in the memory 403 and completes the steps of the aforementioned method in combination with its hardware.

[0128] In an exemplary embodiment, the electronic device may be implemented by one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers (MCUs), microprocessors, or other electronic components to perform the aforementioned method.

[0129] It is understood that the memory 403 in this embodiment can be volatile memory or non-volatile memory, or both. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), ferromagnetic random access memory (FRAM), flash memory, magnetic surface memory, optical disc, or compact disc read-only memory (CD-ROM); magnetic surface memory can be disk storage or magnetic tape storage. Volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Synchronous Static Random Access Memory (SSRAM), Dynamic Random Access Memory (DRAM), Synchronous Dynamic Random Access Memory (SDRAM), Double Data Rate Synchronous Dynamic Random Access Memory (DDRSDRAM), Enhanced Synchronous Dynamic Random Access Memory (ESDRAM), SyncLink Dynamic Random Access Memory (SLDRAM), and Direct Rambus Random Access Memory (DRRAM).The memories described in the embodiments of this application are intended to include, but are not limited to, these and any other suitable types of memories.

[0130] In an exemplary embodiment, this application also provides a storage medium, namely a computer storage medium, specifically a computer-readable storage medium, such as a memory 403 storing a computer program, which can be executed by a processor 402 of an electronic device to complete the steps described in the aforementioned method. The computer-readable storage medium may be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface memory, optical disc, or CD-ROM.

[0131] In an exemplary embodiment, this application also provides a computer program product, including a computer program that can be executed by a processor 402 of an electronic device to perform the steps described in the foregoing method.

[0132] It should be noted that terms such as "first" and "second" are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0133] Furthermore, the technical solutions described in the embodiments of this application can be combined arbitrarily without conflict.

[0134] The above description is merely a preferred embodiment of this application and is not intended to limit the scope of protection of this application.

Claims

1. An intrusion detection method, characterized in that, The method includes: Retrieve the SQL operation logs from the database; The SQL operation log is encoded into a time-series image, wherein the first dimension feature of the time-series image corresponds to the time sequence of the SQL operation log, and the second dimension feature of the time-series image corresponds to the SQL operation type of the SQL operation log; The time-series image is input into the target detection model to obtain the detection result output by the target detection model, wherein the target detection model is used to detect intrusion behavior; If the detection result indicates the presence of intrusion, the security risk of the intrusion is assessed to obtain the risk response level of the intrusion. Perform the interception operation corresponding to the risk response level.

2. The method according to claim 1, characterized in that, Encoding the SQL operation log into a time-series image includes: Based on the operation attributes of the SQL operation log, the SQL operation log is encoded into a time-series image; wherein, the operation attributes include a security risk coefficient, operation frequency, and IP address; the time-series image includes a first color channel, a second color channel, and a third color channel, wherein the first color channel corresponds to the security risk coefficient, the second color channel corresponds to the operation frequency, and the third color channel corresponds to the IP address.

3. The method according to claim 1, characterized in that, The process of obtaining the SQL operation logs from the database includes: Retrieve database logs; Filter out non-SQL operation records from the database log to obtain the filtered database log; The missing fields in the filtered database logs are filled to obtain the filled database logs. The database logs after the filling process are standardized to obtain the SQL operation logs.

4. The method according to claim 1, characterized in that, The target detection model includes an input layer, a backbone network, a neck network, and a head network; the step of inputting the temporal image into the target detection model and obtaining the detection result output by the target detection model includes: The time series image is input into the input layer, and the input layer is used to map the time series image to a preset size; The time series image of the preset size is input into the backbone network, and the image features of the time series image are extracted using the backbone network to obtain the first feature map of the time series image; The first feature map is input into the neck network to obtain a second feature map; wherein, the neck network includes a feature pyramid network with a temporal attention mechanism; The second feature map is input into the head network to obtain the detection result, wherein the detection result includes the image coordinates, risk category, confidence level and temporal continuity score corresponding to the intrusion behavior, and the temporal continuity score is used to evaluate the duration of the intrusion behavior.

5. The method according to claim 4, characterized in that, The method further includes: Obtain a training set, wherein the training set includes multiple sample images and sample labels corresponding to each sample image, and the sample images are obtained by encoding the historical operation logs of the database; Each sample image in the training set is input into the target detection model to obtain the output result of the target detection model; Based on the output results and the corresponding sample labels, the model loss is calculated; wherein, the model loss includes localization loss, classification loss and temporal continuity loss, the localization loss is used to measure the deviation between the image coordinates of the output results and the image coordinates of the sample labels, the classification loss is used to measure the deviation between the risk category of the output results and the risk category of the sample labels, and the temporal continuity loss is used to measure the deviation between the temporal continuity score of the output results and the temporal continuity score of the sample labels. The network parameters of the target detection model are adjusted based on the model loss to obtain an optimized target detection model; After multiple rounds of optimization, the trained target detection model was obtained.

6. The method according to claim 1, characterized in that, The execution of the interception operation corresponding to the risk response level includes: If the risk response level is the first response level, a warning message for the intrusion behavior is generated; If the risk response level is the second response level, a rollback operation will be performed on the transaction corresponding to the intrusion behavior; If the risk response level is level 3, the session corresponding to the intrusion behavior will be terminated. The risk response levels corresponding to the first response level, the second response level, and the third response level increase sequentially.

7. The method according to any one of claims 1 to 6, characterized in that, The method further includes: On the time-series image, image regions corresponding to intrusion behaviors of different durations are marked by detection boxes of different sizes.

8. An electronic device, characterized in that, include: Processor and memory used to store computer programs that can run on the processor; When the processor is used to run a computer program, it executes the steps of the method according to any one of claims 1 to 7.

9. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

Images