Method, device and storage medium for data association of application interface and database table
Patent Information
- Application Number
- CN202611103236.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-07-23
- Publication Date
- 2026-10-09
AI Technical Summary
[0005]本发明的主要目的在于解决在应用接口日志与数据库审计日志来源异构和格式不统一的条件下，难以准确建立应用接口与数据库表之间的关联关系的技术问题
[0016]在本发明实施例中，通过对应用接口日志和数据库审计日志进行统一化处理、特征提取、关联分析及链路构建，能够在异构日志条件下准确建立应用接口与数据库表之间的关联关系，并形成数据库表经应用接口输出的数据链路，实现了在异构日志条件下从应用接口至数据库表清晰的数据链路构建，解决了在应用接口日志与数据库审计日志来源异构和格式不统一的条件下，难以准确建立应用接口与数据库表之间的关联关系的技术问题。
Smart Images
Figure CN122885073A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of log analysis, and in particular to a method, device, and storage medium for data association between an application interface and a database table. Background Technology
[0002] With the continuous advancement of enterprise digital transformation, application programming interfaces (APIs) have become crucial channels for business systems to provide data services and facilitate system interactions. Databases, as the core storage carriers of business data, especially sensitive data, bear the important functions of data storage, querying, and supporting business responses. In actual business operations, the response content of APIs typically originates from database query results, and sensitive data in the database is often transmitted to external terminals or other business systems through APIs. Therefore, establishing the correspondence between APIs and database tables, and further identifying the data links from database tables output through APIs, is of great significance for data security auditing, sensitive data flow analysis, and security incident tracing.
[0003] In existing technologies, security log analysis products typically collect application interface logs and database audit logs separately. Application interface logs generally record information such as interface address, call time, client address, request parameters, response content, and call status; database audit logs generally record information such as database instance, execution account, execution time, SQL statement, operation object, and query results. Existing solutions mostly perform statistical analysis and alarm analysis on the two types of logs separately, such as interface call frequency statistics, abnormal access identification, database operation type analysis, and abnormal query identification.
[0004] However, existing technologies typically fail to provide a unified organization and deep correlation between application interface logs and database audit logs, making it difficult to recover the true data flow relationships from these two types of logs. Some solutions rely on manually configuring the mapping relationship between application interfaces and database tables, or simply matching based on a single dimension such as address information or business name, resulting in insufficient accuracy in the correlation. Furthermore, the statically configured relationship is difficult to update in a timely manner when interfaces are added, database tables are adjusted, or business logic changes. Therefore, a technology is needed to address the technical problem of accurately establishing the correlation between application interfaces and database tables under conditions of heterogeneous sources and inconsistent formats of application interface logs and database audit logs. Summary of the Invention
[0005] The main objective of this invention is to solve the technical problem of difficulty in accurately establishing the relationship between application interfaces and database tables when application interface logs and database audit logs have heterogeneous sources and inconsistent formats.
[0006] The first aspect of this invention provides a method for associating data between an application interface and a database table, the method comprising: Collect application interface logs and database audit logs, and perform unified processing on the application interface logs and database audit logs to obtain a log dataset; Based on the log dataset, the interface response data features in the application interface logs and the query result data features in the database audit logs are extracted to obtain a feature dataset. Based on the feature dataset, correlation analysis is performed on the application interface logs and the database audit logs to obtain a correlation result set between the application interface and the database table; Based on the associated result set and the feature dataset, a link dataset of sensitive data is constructed, which is output from the database table via the application interface.
[0007] Optionally, in a first implementation of the first aspect of the present invention, the step of unifying the application interface logs and the database audit logs to obtain a log dataset includes: Extract fields from application interface logs and database audit logs respectively to generate raw field data; The original field data is mapped and formatted to generate unified field data; The unified field data is restructured to generate a log dataset.
[0008] Optionally, in a second implementation of the first aspect of the present invention, the step of structurally reorganizing the unified field data to generate a log dataset includes: Based on preset log organization rules, the unified field data is classified and arranged to generate log record data; The log data is stored according to the source of application interface logs and database audit logs to generate a unified log collection; The unified log record set is collected and organized to generate a log dataset.
[0009] Optionally, in a third implementation of the first aspect of the present invention, the step of extracting interface response data features from the application interface logs and query result data features from the database audit logs based on the log dataset to obtain a feature dataset includes: Locate the interface response content corresponding to the application interface log and the query result content corresponding to the database audit log from the log dataset, and generate the content data to be extracted. The content data to be extracted is subjected to content extraction to generate candidate feature data; The candidate feature data are labeled and organized to generate a feature dataset.
[0010] Optionally, in a fourth implementation of the first aspect of the present invention, the step of labeling and organizing the candidate feature data to generate a feature dataset includes: The candidate feature data is classified and labeled to generate feature label data; Establish the correspondence between the feature-labeled data and the source logs, and generate feature-correspondence data; A feature dataset is generated based on the feature-labeled data and the corresponding feature data.
[0011] Optionally, in a fifth implementation of the first aspect of the present invention, the step of performing correlation analysis on the application interface logs and the database audit logs based on the feature dataset to obtain a correlation result set between the application interface and the database table includes: The interface response data features corresponding to the application interface logs are matched and calculated with the query result data features corresponding to the database audit logs to generate candidate related data with feature matching degree; Based on the time sequence of application interface logs and database audit logs, dynamic time window verification is performed on the candidate related data to generate time sequence verification data. By combining the feature matching degree of the candidate association data and the time-series verification data, the candidate association data is filtered to generate valid association data. Based on the effective associated data, a result set of associations between the application interface and the database table is generated.
[0012] Optionally, in a sixth implementation of the first aspect of the present invention, the step of filtering the candidate association data by combining the feature matching degree of the candidate association data and the time-series verification data to generate valid association data includes: Extract the API call time from the application interface logs and the query execution time from the database audit logs; Determine whether the interface call time and the query execution time meet a preset time matching window, wherein the conditions of the time matching window are: the query execution time is less than or equal to the interface call time, and the interface call time is less than or equal to the query execution time plus a preset time threshold; Candidate associated data that meet the time matching window are marked as passing the time sequence verification, and valid associated data is generated.
[0013] Optionally, in the seventh implementation of the first aspect of the present invention, the step of constructing a link dataset of sensitive data output from the database table via the application interface based on the association result set and the feature dataset includes: Based on the association result set, the association relationship between the database table and the application interface is determined, and link association data is generated; Based on the feature dataset, determine the content transmitted in the association and generate link feature data; A link dataset is generated by fusing the link association data and the link feature data.
[0014] A second aspect of the present invention provides a data association device for an application interface and a database table, comprising: a memory and at least one processor, wherein the memory stores instructions, and the memory and the at least one processor are interconnected via a circuit; the at least one processor invokes the instructions in the memory to cause the data association device for the application interface and the database table to execute the aforementioned data association method for the application interface and the database table.
[0015] A third aspect of the present invention provides a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the above-described application interface and database table data association method.
[0016] In this embodiment of the invention, by performing unified processing, feature extraction, correlation analysis, and link construction on application interface logs and database audit logs, the association between application interfaces and database tables can be accurately established under heterogeneous log conditions, and a data link output from the database table to the application interface can be formed. This realizes the construction of a clear data link from the application interface to the database table under heterogeneous log conditions, and solves the technical problem that it is difficult to accurately establish the association between application interfaces and database tables under the conditions of heterogeneous sources and inconsistent formats of application interface logs and database audit logs. Attached Figure Description
[0017] Figure 1 This is a schematic diagram of an embodiment of the data association method between the application interface and the database table in this invention. Figure 2 This is a schematic diagram of a specific embodiment of the 101 steps of the data association method between the application interface and the database table in this invention. Figure 3 This is a schematic diagram of a specific embodiment of the 102 steps of the data association method between the application interface and the database table in this invention. Figure 4 This is a schematic diagram of a specific embodiment of the 103 steps of the data association method between the application interface and the database table in this invention. Figure 5 This is a schematic diagram of an embodiment of a data association device between an application interface and a database table in this invention. Detailed Implementation
[0018] This invention provides a method, device, and storage medium for data association between an application interface and a database table.
[0019] The embodiments of the present invention will now be described in more detail with reference to the accompanying drawings. While some embodiments of the present invention are shown in the drawings, it should be understood that the present invention can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the accompanying drawings and embodiments are for illustrative purposes only and are not intended to limit the scope of protection of the present invention.
[0020] In the description of the embodiments disclosed in this invention, the term "comprising" and similar terms should be understood as open-ended inclusion, i.e., "including but not limited to". The term "based on" should be understood as "at least partially based on". The term "one embodiment" or "the embodiment" should be understood as "at least one embodiment". The terms "first", "second", etc., may refer to different or the same objects. Other explicit and implicit definitions may also be included below.
[0021] For ease of understanding, the specific process of the embodiments of the present invention is described below. Please refer to [link / reference]. Figure 1 One embodiment of the data association method between the application interface and the database table in this invention includes: 101. Collect application interface logs and database audit logs, and perform unified processing on the application interface logs and the database audit logs to obtain a log dataset; In this embodiment, application interface logs and database audit logs can be accessed through log collection agents, traffic monitoring devices, database audit device interfaces, or by importing log files. Application interface logs include information such as interface address, interface identifier, call time, client address, response content, call status, and the business module to which it belongs. Database audit logs may include information such as database instance identifier, database name, table name, SQL statement, query execution time, execution account, initiating address, and query results.
[0022] Because the two types of logs come from different sources, have different field formats, and different content structures, it is necessary to first extract fields from the application interface logs and database audit logs separately to generate raw field data; then, perform field mapping and format conversion on the raw field data to generate unified field data; finally, restructure the unified field data to generate a log dataset. Through the above processing, heterogeneous log data can be unified into a single processing framework, providing a standardized foundation for subsequent feature extraction and correlation analysis.
[0023] For details, please refer to Figure 2 , Figure 2 This is a schematic diagram of a specific embodiment of the data association method between the application interface and the database table in this invention. The 101 steps include the following specific implementation methods: 1011. Extract fields from application interface logs and database audit logs respectively to generate raw field data; 1012. Perform field mapping and format conversion on the original field data to generate unified field data; 1013. The unified field data is restructured in a structured manner to generate a log dataset.
[0024] In steps 1011-1013, the user calls the application interface " / api / user / getInfo" to query user information. The information recorded in the application interface log is: interface address " / api / user / getInfo", call time "2026-06-25 10:15:23", and response content "Name: Zhang San, Mobile Number: 13800138000"; the information recorded in the database audit log is: data table "user_info", query execution time "2026-06-25 10:15:22", and query result "Name: Zhang San, Mobile Number: 13800138000".
[0025] Fields are extracted from application interface logs and database audit logs to generate raw field data. For application interface logs, the interface address, call time, and response content are extracted; for database audit logs, the data table, query execution time, and query results are extracted.
[0026] The "call time" in the application interface log and the "query execution time" in the database audit log are uniformly mapped to "log time", and the "response content" and "query result" are uniformly mapped to "content data", thus obtaining uniform field data with consistent format.
[0027] The unified field data is restructured to generate a log dataset. Application interface logs can be organized as "Log Source = Application Interface Log, Log Time = 2026-06-25 10:15:23, Object = / api / user / getInfo, Content Data = Name: Zhang San, Mobile Number: 13800138000", and database audit logs can be organized as "Log Source = Database Audit Log, Log Time = 2026-06-25 10:15:22, Object = user_info, Content Data = Name: Zhang San, Mobile Number: 13800138000". These two sets of logs are then combined to form a log dataset for subsequent correlation analysis.
[0028] Furthermore, step 1011 includes the following specific implementation methods: 10111. Based on preset log organization rules, classify and arrange the unified field data to generate log record data; 10112. Store the log records according to their sources (application interface logs and database audit logs) to generate a unified log record set; 10113. Collect and organize the unified log record set to generate a log dataset.
[0029] In steps 10111-10113, the preset log organization rules may include at least one of the following: (1) Field order rule: The fields are arranged in the order of "log source - log time - object - content data"; (2) Field naming rules: Use unified field names to standardize the expression of heterogeneous fields in logs from different sources. Among them, "call time" and "query execution time" are uniformly named "log time", "interface address" and "data table" are uniformly abstracted as "object", and "response content" and "query result" are uniformly named "content data". (3) Data type rules: Convert log times to standard time format, convert object fields to string format, and convert content data to text or key-value pair format; (4) Classification and identification rules: Add a source identification field based on the original source of the logs to distinguish between application interface logs and database audit logs; (5) Integrity verification rules: Verify the required fields in the log records. If there are empty values, missing values or abnormal formats, complete, correct or mark the abnormality.
[0030] For the unified field data generated by the application interface logs, it can be arranged according to the above log organization rules as follows: "Log source = application interface log, log time = 2026-06-25 10:15:23, object = / api / user / getInfo, content data = name: Zhang San, mobile number: 13800138000".
[0031] For the unified field data generated by the database audit log, it can be arranged according to the above log organization rules as follows: "Log source = database audit log, log time = 2026-06-25 10:15:22, object = user_info, content data = name: Zhang San, mobile phone number: 13800138000".
[0032] After generating standardized log data, different types of log records are stored according to their source to construct a unified log record set. Corresponding storage does not require physical isolation; logical differentiation can be achieved within the same storage space using source identifiers, directory partitions, index tags, or data table fields. Log data generated from application interface logs is stored in the application interface log area. Log data generated from database audit logs is stored in the database audit log area. A unified field structure and source identifier are retained in each log record to enable retrieval and retrieval of log records from different sources within the same data framework.
[0033] After forming a unified log record set, the log records in the set are collected and organized according to the preset dataset construction rules to generate a log dataset that can be used for subsequent analysis.
[0034] For the business behavior of a user calling the application interface " / api / user / getInfo" to query user information, the following two records can be extracted from the unified log collection: The first record is "Log source = Database audit log, Log time = 2026-06-25 10:15:22, Object = user_info, Content data = Name: Zhang San, Mobile number: 13800138000"; The second record is: "Log source = Application interface log, Log time = 2026-06-25 10:15:23, Object = / api / user / getInfo, Content data = Name: Zhang San, Mobile number: 13800138000".
[0035] Since the two records are close in time, consistent in content, and have a business call relationship between the objects, they can be determined to belong to the same query behavior. Therefore, the two records are aggregated and organized into a corresponding log dataset.
[0036] 102. Based on the log dataset, extract the interface response data features from the application interface logs and the query result data features from the database audit logs to obtain a feature dataset; In this embodiment, the log dataset has been formed by field extraction, field mapping, and structured reorganization of application interface logs and database audit logs. Therefore, under a unified field structure, the actual data content carried in the logs can be further identified, and key data features that can be used for correlation analysis can be extracted from them.
[0037] Data features can be field names, field values, key-value pairs, text fragments, numeric strings, identifiers, sensitive attribute items, or combinations thereof, used to characterize the data consistency, similarity, or transitive relationship between the application interface output and the database query results.
[0038] For details, please refer to Figure 3 , Figure 3 This is a schematic diagram of a specific embodiment of the data association method between the application interface and the database table in this invention. The 102 steps include the following specific implementation methods: 1021. Locate the interface response content corresponding to the application interface log and the query result content corresponding to the database audit log from the log dataset respectively, and generate the content data to be extracted; 1022. Extract content from the data to be extracted to generate candidate feature data; 1023. The candidate feature data is labeled and organized to generate a feature dataset.
[0039] In steps 1021-1023, the content data in the application interface log is "Name: Zhang San, Mobile Number: 13800138000", and the content data in the database audit log is also "Name: Zhang San, Mobile Number: 13800138000". Therefore, these two parts of content can be located and extracted as the interface response content and query result content, respectively, forming the content data to be extracted.
[0040] Content extraction is performed on the interface response content and query result content to extract candidate feature data that can reflect the meaning and transmission characteristics of the data.
[0041] For example: field name features such as "name", "mobile phone number", "ID number", "address", etc.; field value features such as "Zhang San" and "13800138000"; and key-value pair features such as "name: Zhang San" and "mobile phone number: 13800138000".
[0042] For the content "Name: Zhang San, Mobile Number: 13800138000", the following candidate feature data can be extracted: 1. Field name features: "Name" and "Mobile Number"; 2. Field value features: "Zhang San" and "13800138000"; 3. Key-value pair features: "Name: Zhang San" and "Mobile Number: 13800138000". "Mobile Number" and its corresponding value can also be marked as candidate features for sensitive information.
[0043] After obtaining the candidate feature data, in order to facilitate the unified comparison and correlation analysis of application interface logs and database audit logs, the candidate feature data needs to be standardized, labeled and structured.
[0044] Furthermore, step 1023 includes the following specific implementation methods: 10231. Classify and label the candidate feature data to generate feature label data; 10232. Establish the correspondence between the feature-labeled data and the source logs, and generate feature-corresponding data; 10233. Based on the feature-labeled data and the feature-corresponding data, generate a feature dataset.
[0045] In steps 10231-10233, “Name” is marked as an identity information field, “Mobile Number” is marked as a contact information field, “Zhang San” is marked as a text-type feature value, “13800138000” is marked as a numeric string-type feature value and further marked as sensitive data, and “Name: Zhang San” and “Mobile Number: 13800138000” are marked as key-value pair features.
[0046] After completing the feature classification and labeling, a mapping relationship is further established between each feature label data and its source log to clarify which application interface log or database audit log the feature originates from. For example, the feature "Mobile number: 13800138000" extracted from the application interface log " / api / user / getInfo" can be mapped to "Log source = application interface log, object = / api / user / getInfo, log time = 2026-06-25 10:15:23". For the same characteristics extracted from the database audit log "user_info", a correspondence can be established between them and "log source = database audit log, object = user_info, log time = 2026-06-25 10:15:22".
[0047] Based on the feature-labeled data and the feature-corresponding data, a feature dataset is generated, including the following records: Feature 1: Feature Name = Name, Feature Value = Zhang San, Feature Type = Identity Information, Source Log = Application Interface Log, Object = / api / user / getInfo, Log Time = 2026-06-25 10:15:23; Feature 2: Feature Name = Mobile Number, Feature Value = 13800138000, Feature Type = Contact Information, Sensitive Marker = Yes, Source Log = Application Interface Log, Object = / api / user / getInfo, Log Time = 2026-06-25 10:15:23; Feature 3: Feature Name = Name, Feature Value = Zhang San, Feature Type = Identity Information, Source Log = Database Audit Log, Object = user_info, Log Time = 2026-06-25 10:15:22; Feature 4: Feature Name = Mobile Number, Feature Value = 13800138000, Feature Type = Contact Information, Sensitive Marker = Yes, Source Log = Database Audit Log, Object = user_info, Log Time = 2026-06-25 10:15:22.
[0048] The above methods can form a feature dataset with a unified structure, clear source, and comparable semantics, providing direct data support for subsequent correlation analysis between application interfaces and database tables.
[0049] 103. Based on the feature dataset, perform correlation analysis on the application interface logs and the database audit logs to obtain a correlation result set between the application interface and the database table; In this embodiment, after obtaining the feature dataset, the similarity, consistency and temporal relationship between the interface response data features corresponding to the application interface logs and the query result data features corresponding to the database audit logs can be used to perform correlation analysis on the two types of logs, so as to identify whether the data in a certain database table is output to the outside via a certain application interface, thereby obtaining the correlation result set between the application interface and the database table.
[0050] For details, please refer to Figure 4 , Figure 4 This is a schematic diagram of a specific embodiment of step 103 of the data association method between the application interface and the database table in this invention. Step 103 includes the following specific implementation methods: 1031. Perform matching calculations on the interface response data features corresponding to the application interface logs and the query result data features corresponding to the database audit logs to generate candidate related data with feature matching degree; 1032. Based on the time sequence of application interface logs and database audit logs, perform dynamic time window verification on the candidate related data to generate time sequence verification data; 1033. Combining the feature matching degree of the candidate association data and the time-series verification data, the candidate association data is filtered to generate valid association data; 1034. Based on the effective associated data, generate an association result set between the application interface and the database table.
[0051] In steps 1031-1034, when both the application interface log and the database audit log contain "Name: Zhang San" and "Mobile Number: 13800138000", a high feature matching degree can be obtained, and a candidate related data can be generated. The candidate related data includes at least the following: interface object, database table object, matching feature item, matching degree score, and corresponding time information.
[0052] Relying solely on feature content matching may be affected by duplicate data, common fields, or historical query results. Therefore, it is also necessary to perform time-series verification on candidate related data by combining log occurrence times. Generally, the database query execution time should precede or equal the application interface call time, and the two should fall within a reasonable business processing time window. The dynamic time window can be set based on system type, interface response latency, database access mode, business complexity, or historical statistical results. For real-time query interfaces, a smaller time threshold can be set; for aggregation calculation interfaces or multiple query interfaces, the time threshold can be appropriately relaxed.
[0053] After obtaining candidate association data and time-series verification data, the validity of the candidate association data can be judged based on preset filtering rules. Candidate association data with low matching degree, cross-time series, accidental similarity, or lack of business relevance will be eliminated, and only valid association data that can truly reflect the data relationship between the interface and the database table will be retained.
[0054] After obtaining valid associated data, it can be summarized and organized according to interface dimension, database table dimension, or interface-table pair dimension to form an association result set between application interface and database table.
[0055] Furthermore, step 1033 includes the following specific implementation methods: 10331. Extract the interface call time from the application interface logs and the query execution time from the database audit logs; 10332. Determine whether the interface call time and the query execution time meet a preset time matching window, wherein the condition of the time matching window is: the query execution time is less than or equal to the interface call time, and the interface call time is less than or equal to the query execution time plus a preset time threshold. 10333. Mark the candidate associated data that meets the time matching window as having passed the time sequence verification, and generate valid associated data.
[0056] In steps 10331-10333, the interface call time from the application interface logs and the query execution time from the database audit logs are extracted from the source logs corresponding to the candidate related data. The extracted time information can be uniformly converted into the same time format for time comparison and range judgment.
[0057] The system determines whether the database query and the API response occur within a reasonable business continuity time range based on a preset time threshold. If the query execution time is earlier than or equal to the API call time, and the API call time does not exceed the query execution time plus the preset time threshold, then the two are considered to meet the time matching window condition.
[0058] When the query execution time in the database audit log is "2026-06-25 10:15:22" and the interface call time in the application interface log is "2026-06-25 10:15:23", if the preset time threshold is 5 seconds, then there is a judgment logic: 10:15:22≤10:15:23≤10:15:27, thus satisfying the time matching window condition.
[0059] For candidate related data that meet the time matching window conditions, mark them as "Time series verification result = Pass". For candidate related data that do not meet the above conditions, mark them as "Time series verification result = Fail" or remove them directly. Subsequently, candidate related data that pass the time series verification and simultaneously meet the preset matching conditions are determined as valid related data.
[0060] 104. Based on the association result set and the feature dataset, construct a link dataset of sensitive data output from the database table through the application interface.
[0061] In this embodiment, after determining that there is a relationship between the application interface and the database table, the transmission process of sensitive data being read from the database table, responded to by the application interface, and output externally can be further restored based on the association result set and feature dataset, thereby constructing a sensitive data output link dataset.
[0062] Specifically, step 104 includes the following specific implementation methods: 1041. Based on the association result set, determine the association relationship between the database table and the application interface, and generate link association data; 1042. Based on the feature dataset, determine the content transmitted in the association relationship and generate link feature data; 1043. Based on the link association data and the link feature data, a link dataset is generated by fusion.
[0063] In steps 1041-1043, database tables and application interfaces with confirmed relationships are extracted from the association result set, forming the basic association edges from the database tables to the application interfaces. For example, it can be determined that there is a verified association between "database table = user_info" and "application interface = / api / user / getInfo", and this is saved as a link association data.
[0064] After establishing the association between the database table and the application interface, further data features that appear at both ends and satisfy the matching relationship are extracted from the feature dataset to determine which specific data content is transmitted from the database table to the application interface. Link feature data can include information such as the name of the transmitted field, the value of the transmitted field, the field category, the sensitivity level, the location of occurrence, the matching method, and the matching confidence level. For example, in the association between the database table "user_info" and the application interface " / api / user / getInfo", it can be determined that "Name: Zhang San" and "Mobile Number: 13800138000" are the actual transmitted content, where "Mobile Number" can be marked as a sensitive data field, and "Name" can be marked as a general identity information field.
[0065] The link association data and link feature data are fused to form a complete sensitive data output link dataset, which may include the following link descriptions: Source database table = user_info; Output application interface = / api / user / getInfo; Pass fields = {name, mobile number}; Sensitive field = {phone number}; Database query time = 2026-06-25 10:15:22; Interface output time = 2026-06-25 10:15:23; Link status = Established; Link reliability = high.
[0066] The link dataset can also include link number, business scenario identifier, output direction identifier, field sensitivity level, associated feature evidence, corresponding log record set, and visualization information, so that it can be called in subsequent audit, tracking or risk identification scenarios.
[0067] In this embodiment of the invention, by performing unified processing, feature extraction, correlation analysis, and link construction on application interface logs and database audit logs, the association between application interfaces and database tables can be accurately established under heterogeneous log conditions, and a data link output from the database table to the application interface can be formed. This realizes the construction of a clear data link from the application interface to the database table under heterogeneous log conditions, and solves the technical problem that it is difficult to accurately establish the association between application interfaces and database tables under the conditions of heterogeneous sources and inconsistent formats of application interface logs and database audit logs.
[0068] Figure 5This is a schematic diagram of the structure of a data association device 500 for an application interface and a database table provided in an embodiment of the present invention. The data association device 500 can vary significantly due to different configurations or performance characteristics, and may include one or more central processing units (CPUs) 510 and memory 520, and one or more storage media 530 for storing application programs 533 or data 532. The memory 520 and storage media 530 can be temporary or persistent storage. The program stored in the storage media 530 may include one or more modules (not shown in the diagram), each module including a series of instruction operations on the data association device 500. Furthermore, the processor 510 may be configured to communicate with the storage media 530 and execute the series of instruction operations in the storage media 530 on the data association device 500.
[0069] The data association device 500 based on the application interface and database table may also include one or more power supplies 540, one or more wired or wireless network interfaces 550, one or more input / output interfaces 560, and / or one or more operating systems 531, such as Windows Server, Mac OS X, Unix, Linux, Free BSD, etc. Those skilled in the art will understand that... Figure 5 The illustrated data association device structure between the application interface and the database table does not constitute a limitation on the data association device based on the application interface and the database table. It may include more or fewer components than illustrated, or combine certain components, or have different component arrangements.
[0070] The present invention also provides a computer-readable storage medium, which can be a non-volatile computer-readable storage medium or a volatile computer-readable storage medium, wherein the computer-readable storage medium stores instructions that, when the instructions are executed on a computer, cause the computer to perform the steps of the data association method between the application interface and the database table.
[0071] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.
[0072] Furthermore, although the operations are described in a specific order, this should be understood as requiring that such operations be performed in the specific order shown or in sequential order, or requiring that all illustrated operations be performed to achieve the desired result. In certain environments, multitasking and parallel processing may be advantageous. Similarly, although several specific implementation details are included in the above discussion, these should not be construed as limiting the scope of this disclosure. Certain features described in the context of individual embodiments may also be implemented in combination in a single implementation. Conversely, various features described in the context of a single implementation may also be implemented individually or in any suitable sub-combination in multiple implementations.
[0073] Although the subject matter has been described using language specific to structural features and / or methodological logic, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. Rather, the specific features and actions described above are merely illustrative examples of implementing the claims.
Claims
1. A method for data association between an application interface and a database table, characterized in that, Including the following steps: Collect application interface logs and database audit logs, and perform unified processing on the application interface logs and database audit logs to obtain a log dataset; Based on the log dataset, the interface response data features in the application interface logs and the query result data features in the database audit logs are extracted to obtain a feature dataset. Based on the feature dataset, correlation analysis is performed on the application interface logs and the database audit logs to obtain a correlation result set between the application interface and the database table; Based on the associated result set and the feature dataset, a link dataset of sensitive data is constructed, which is output from the database table through the application interface.
2. The method for associating application interfaces with database tables according to claim 1, characterized in that, The step of unifying the application interface logs and the database audit logs to obtain the log dataset includes: Extract fields from application interface logs and database audit logs respectively to generate raw field data; The original field data is mapped and formatted to generate unified field data; The unified field data is restructured to generate a log dataset.
3. The method for associating application interfaces with database tables according to claim 2, characterized in that, The step of structurally reorganizing the unified field data to generate a log dataset includes: Based on preset log organization rules, the unified field data is classified and arranged to generate log record data; The log data is stored according to the source of application interface logs and database audit logs to generate a unified log collection; The unified log record set is collected and organized to generate a log dataset.
4. The method for associating application interfaces with database tables according to claim 1, characterized in that, The step of extracting interface response data features from the application interface logs and query result data features from the database audit logs based on the log dataset to obtain a feature dataset includes: Locate the interface response content corresponding to the application interface log and the query result content corresponding to the database audit log from the log dataset, and generate the content data to be extracted. The content data to be extracted is subjected to content extraction to generate candidate feature data; The candidate feature data are labeled and organized to generate a feature dataset.
5. The method for associating application interfaces with database tables according to claim 4, characterized in that, The step of labeling and organizing the candidate feature data to generate a feature dataset includes: The candidate feature data is classified and labeled to generate feature label data; Establish the correspondence between the feature-labeled data and the source logs, and generate feature-correspondence data; A feature dataset is generated based on the feature-labeled data and the corresponding feature data.
6. The method for associating application interfaces with database tables according to claim 1, characterized in that, The step of performing correlation analysis on the application interface logs and the database audit logs based on the feature dataset to obtain the correlation result set between the application interface and the database table includes: The interface response data features corresponding to the application interface logs are matched and calculated with the query result data features corresponding to the database audit logs to generate candidate related data with feature matching degree; Based on the time sequence of application interface logs and database audit logs, dynamic time window verification is performed on the candidate related data to generate time sequence verification data. By combining the feature matching degree of the candidate association data and the time-series verification data, the candidate association data is filtered to generate valid association data. Based on the effective associated data, a result set of associations between the application interface and the database table is generated.
7. The method for associating application interfaces with database tables according to claim 6, characterized in that, The step of filtering the candidate association data and generating valid association data by combining the feature matching degree of the candidate association data and the time-series verification data includes: Extract the API call time from the application interface logs and the query execution time from the database audit logs; Determine whether the interface call time and the query execution time meet a preset time matching window, wherein the conditions of the time matching window are: the query execution time is less than or equal to the interface call time, and the interface call time is less than or equal to the query execution time plus a preset time threshold; Candidate associated data that meet the time matching window are marked as passing the time sequence verification, and valid associated data is generated.
8. The method for associating application interfaces with database tables according to claim 1, characterized in that, The step of constructing a link dataset of sensitive data output from a database table via an application interface based on the association result set and the feature dataset includes: Based on the association result set, the association relationship between the database table and the application interface is determined, and link association data is generated; Based on the feature dataset, determine the content transmitted in the association and generate link feature data; A link dataset is generated by fusing the link association data and the link feature data.
9. A device for data association between an application interface and a database table, characterized in that, The data association device between the application interface and the database table includes: a memory and at least one processor, wherein the memory stores instructions, and the memory and the at least one processor are interconnected via a line; The at least one processor invokes the instructions in the memory to cause the application interface and database table data association device to perform the application interface and database table data association method as described in any one of claims 1-8.
10. A computer-readable storage medium storing a computer program thereon, characterized in that, When the computer program is executed by the processor, it implements the data association method between the application interface and the database table as described in any one of claims 1-8.