A network security protection method and system based on database protocol analysis

Abstract

The application discloses a network security protection method and system based on database protocol analysis, relates to the technical field of network security protection, acquires database access traffic information, to-be-protected database asset information, application session information and a protection rule set, carries out session reorganization on the database access traffic information, obtains a database access session, carries out database protocol analysis on the database access session according to a database protocol type and generates a protocol analysis result, and constructs three-layer associated access records based on the application session information and the database access session. Through session reorganization and protocol analysis on the database access traffic, the scheme extracts database native operation information such as SQL statements, operation commands and access objects, can identify abnormal access and attack behaviors from the dimension of actual operation behaviors of the database, makes up for the deficiency that traditional firewalls and border gateways only perform shallow traffic filtering, and effectively improves the accuracy of security detection and protection.

Description

Technical Field

[0001] This invention relates to the field of network security protection technology, specifically to a network security protection method and system based on database protocol analysis. Background Technology

[0002] With the continuous advancement of digitalization and informatization in various industries, application system and database-based architecture has become the mainstream deployment form for business platforms. As the core data storage carrier, the database centrally carries various high-value data such as business operation data, user privacy information, transaction data, and core enterprise information. Its secure and stable operation is directly related to business continuity, data security, and compliance management.

[0003] Traditional network firewalls and perimeter security gateways rely solely on transport layer information such as network 5-tuples, ports, and IP addresses for access control. This makes it difficult to identify anomalies at the actual database operation level, resulting in low overall protection accuracy. Furthermore, most existing database protection products only independently collect and analyze database-side traffic. When abnormal access, data leakage, or attacks occur, it is difficult to trace database operation behavior back to the corresponding application account, access point, and application session. This not only increases the difficulty of risk localization and troubleshooting but also makes it difficult to support end-to-end security auditing. Therefore, this paper proposes a network security protection method and system based on database protocol analysis to address the aforementioned problems. Summary of the Invention

[0004] To address the aforementioned technical issues, this paper provides a network security protection method and system based on database protocol analysis. This technical solution solves the problems mentioned in the background technology, where traditional network firewalls, perimeter security gateways, and other devices rely solely on transport layer information such as network 5-tuples, ports, and IP addresses for access control. This makes it difficult to identify anomalies from the actual database operation behavior, resulting in low overall protection accuracy. Furthermore, most existing database protection products only independently collect and analyze database-side traffic. When abnormal access, data leakage, or attacks occur, it is difficult to trace the database operation behavior back to the corresponding application account, access point, and application session. This not only increases the difficulty of risk location and fault diagnosis but also makes it difficult to support end-to-end security auditing.

[0005] To achieve the above objectives, the technical solution adopted by the present invention is as follows: A network security protection method based on database protocol analysis includes: Obtain database access traffic information, database asset information to be protected, application session information, and protection rule set; The database access traffic information is reassembled to obtain the database access session. Based on the database protocol type, the database access session is parsed and the protocol parsing result is generated. Based on application session information and database access session, a three-layer association access record is constructed, which includes application access layer fields, database session layer fields, and database operation layer fields. Based on the database asset information to be protected and the protocol parsing results, generate access object characteristics corresponding to database access behavior; Based on the protocol parsing results, the three-layer association access records, and the characteristics of the accessed objects, database access behavior characteristics are generated. These database access behavior characteristics include access subject characteristics, SQL semantic characteristics, access time characteristics, access frequency characteristics, and sensitive data access characteristics. The database access behavior characteristics are matched with the set of protection rules to obtain the rule hit results. Based on the rule hit results, the risk level of the database access behavior and the final response action are determined. The database access behavior is handled securely according to the final response action, and corresponding risk logs and audit logs are generated based on the security handling results.

[0006] Furthermore, a network security protection system based on database protocol analysis is proposed to implement the network security protection method based on database protocol analysis as described above, including: The data acquisition module is used to acquire database access traffic information, database asset information to be protected, application session information, and protection rule set. The data processing module is used to reassemble the database access traffic information to obtain the database access session, parse the database access session according to the database protocol type and generate the protocol parsing result, and build a three-layer association access record based on the application session information and the database access session. The data analysis module is used to generate access object characteristics corresponding to database access behavior based on the asset information of the database to be protected and the protocol parsing results. It generates database access behavior characteristics based on the protocol parsing results, three-layer associated access records and access object characteristics. It matches the database access behavior characteristics with the set of protection rules to obtain the rule hit results, and determines the risk level of database access behavior and the final response action based on the rule hit results. The execution module is used to perform security measures on database access behavior according to the final response action, and generate corresponding risk logs and audit logs based on the security measures results.

[0007] The beneficial effects of this invention compared to the prior art are: This solution extracts native database operation information such as SQL statements, operation commands, and access objects by performing session reassembly and protocol parsing on database access traffic. It can identify abnormal access and attack behaviors from the perspective of actual database operation behavior, making up for the shortcomings of traditional firewalls and border gateways that only perform shallow traffic filtering. This effectively improves the accuracy of security detection and protection. At the same time, it binds application sessions and database sessions through multiple dimensions such as session identifier, time, and address, and builds a three-layer association access record of application access layer, database session layer, and database operation layer. It connects application accounts, access entry points, and database operation behaviors, enabling rapid end-to-end tracing in the event of a security incident and reducing the difficulty of fault and risk location.

[0008] This solution comprehensively characterizes database access behavior by extracting multiple features such as access subject, access object, SQL semantics, access frequency, and access to sensitive data. It can effectively identify various risk scenarios such as unauthorized access, high-frequency abnormal access, and unauthorized reading of sensitive data. It has the ability to identify both common violations and database attack behaviors, and has a wider threat coverage. Attached Figure Description

[0009] Figure 1 This is a flowchart of a network security protection method based on database protocol analysis proposed in this invention; Figure 2 This is a flowchart illustrating the generation of protocol parsing results in this invention; Figure 3 This is a flowchart illustrating the construction of the three-layer associated access record in this invention; Figure 4 This is a flowchart illustrating the process of determining the characteristics of the access object corresponding to a database access behavior in this invention. Figure 5 This is a flowchart illustrating the generation of database access behavior characteristics in this invention; Figure 6 This is a structural block diagram of a network security protection system based on database protocol analysis proposed in this invention. Detailed Implementation

[0010] The following description is intended to disclose the invention and enable those skilled in the art to implement it. The preferred embodiments described below are merely examples, and other obvious variations will occur to those skilled in the art.

[0011] Reference Figures 1-5 As shown, a network security protection method based on database protocol analysis includes: S1. Obtain database access traffic information, database asset information to be protected, application session information, and protection rule set; Specifically, database access traffic information refers to network communication data generated during database access, database asset information to be protected refers to the database objects and their structure information that need to be protected, application session information refers to application-side access behavior, and the set of protection rules is used to provide a basis for subsequent rule matching, risk assessment, and response action determination.

[0012] Furthermore, the database access traffic information includes data packets, source address, source port, destination address, destination port, session time, and database protocol type; In this context, a data packet refers to a network communication data unit transmitted during database access, used to carry database access requests, database response results, and database protocol interaction information. The source address refers to the network address of the side initiating the database access action, the source port refers to the communication port of the side initiating the database access action, the destination address refers to the network address of the side receiving the database access action, and the destination port refers to the communication port of the side receiving the database access action. Session time refers to the time information corresponding to the database access traffic. Database protocol type refers to the type of database communication protocol used by the database access traffic. Different database protocol types correspond to different protocol formats. Protocol format refers to the rules in the database communication protocol used to organize, transmit, and parse database interaction data, including the composition of protocol messages, the correspondence between data packets and protocol messages, the arrangement of fields in the protocol message, the length information used to determine the integrity of the protocol message, the command identification information used to represent the database operation content, and the pairing rules used to determine whether request messages and response messages belong to the same database interaction.

[0013] Furthermore, the database asset information to be protected includes the database to be protected and its database address, database port, database type, database table structure, and sensitive field information; Among them, the database to be protected refers to the database instance, database service, or database logical library that needs to be included in the security protection scope; the database address refers to the network access address corresponding to the database to be protected, to determine whether the database access behavior points to the database to be protected; the database port refers to the port on which the database to be protected provides database services to the outside world; the database type refers to the database protocol type used by the database to be protected, and each database type has corresponding SQL syntax rules; the database table structure refers to the structured description of the data tables and their fields in the database to be protected; and the sensitive field information refers to the fields in the database to be protected that are marked as sensitive data and their sensitivity information.

[0014] Furthermore, the database table structure includes table objects, field objects, and the correspondence between table objects and field objects; Among them, a table object refers to a data table, view, or other data collection object in the database to be protected that can be accessed by SQL statements, and a field object refers to the data field contained in a table object. The correspondence between table objects and field objects is used to indicate the table object to which a field object belongs.

[0015] Furthermore, the sensitive field information includes sensitive fields, sensitivity levels, and the correspondence between sensitive fields and sensitivity levels; Sensitive fields refer to data fields in the database to be protected that contain personal identity information, account information, transaction information, core business information, or other data that require special protection. Sensitivity level refers to the degree of sensitivity of the data corresponding to the sensitive field, which is used to distinguish the level of security risk of different sensitive fields. The correspondence between sensitive fields and sensitivity levels is used to determine the sensitivity level corresponding to the access field.

[0016] Furthermore, the application session information includes the application account, application address, access time, access URL, session identifier, and application-side auxiliary identifier; Among them, the application account refers to the user account, service account, or business account that initiates the access request in the application system; the application address refers to the source address corresponding to the application access request; the access time refers to the time when the application-side access request is generated; the access URL refers to the unified resource location information corresponding to the application-side access request; the session identifier refers to the identifier information assigned by the application system for an application access session; and the application-side auxiliary identifier refers to information other than the session identifier that can help identify the application session, including request number, tracing identifier, transaction identifier, and gateway forwarding identifier. Furthermore, the set of protection rules includes a trusted access whitelist, access control rules, attack signature rules, and virtual patch rules, wherein the trusted access whitelist includes a template whitelist and a statement whitelist; The template whitelist includes template application accounts, template database users, template target databases, template access tables, template access fields, template SQL templates, and template access time ranges. Template application account refers to the application account that is allowed to access according to the template whitelist; template database user refers to the database user that is allowed to access the database; template target database refers to the target database to which the template whitelist applies; template access table refers to the table object that is allowed to access according to the template whitelist; template access field refers to the field object that is allowed to access according to the template whitelist; template SQL template refers to the SQL structure template formed by normalizing and replacing the constant values ​​in the trusted SQL statement; template access time range refers to the time range during which the template whitelist allows access. The statement whitelist includes trusted SQL statements, trusted database types, trusted database users, trusted client information, and trusted target databases; A trusted SQL statement is a complete SQL statement that is pre-configured as trusted. A trusted database type is the type of database to which the trusted SQL statement is applicable. A trusted database user is the database user who is allowed to execute the trusted SQL statement. Trusted client information is the client source information that is allowed to initiate the trusted SQL statement. A trusted target database is the target database that is allowed to execute the trusted SQL statement.

[0017] It should be noted that the statement whitelist is a set of precise and reliable SQL statements manually configured by the administrator, while the template whitelist is an access behavior model automatically generated by constructing a training set using application accounts, database users, target databases, access tables, access fields, SQL templates, and access time ranges corresponding to historical reliable database access behaviors. This model is created by converting application accounts, database users, target databases, access tables, access fields, SQL templates, and access time ranges from historical reliable database access behaviors into feature fields of the training samples. These training samples are then input into a clustering model or an association rule learning model, which learns the combination relationships between feature fields in different historical reliable database access behaviors. After training, the reliable access behavior pattern output by the clustering model or association rule learning model is determined as the access behavior model, and the application accounts, database users, target databases, access tables, access fields, SQL templates, and access time ranges from the access behavior model are written into the template whitelist. The aforementioned clustering model or association rule learning model can be implemented using existing machine learning models and is considered existing technology, which will not be elaborated upon further here.

[0018] Furthermore, the access control rules include a control subject field, a control object field, a control time field, an access count threshold, a sensitivity level threshold, an access control risk level, and an access control response action; Among them, the control subject field is used to indicate the access subject to which the access control rule applies, the control object field is used to indicate the access object to which the access control rule applies, the control time field is used to indicate the time conditions for allowing or restricting access, the access count threshold is used to indicate the upper limit of the number of times the same access subject is allowed to access the same access object within the session time of the database access session, the sensitivity level threshold is the sensitive data level condition that triggers the access control rule, the access control risk level indicates the risk level corresponding to the access control rule being triggered, and the access control response action is the action that needs to be taken when the access control rule is triggered.

[0019] Furthermore, the attack signature rules include attack signature type, attack SQL signature field, attack risk level, and attack response action; Among them, the attack feature type is used to represent the category of database attack behavior, the attack SQL feature field is used to record the SQL features that can characterize the attack behavior, the attack risk level represents the degree of risk when the attack feature rule is hit, and the attack response action is the handling action that needs to be performed when the attack feature rule is hit.

[0020] Furthermore, the virtual patch rules include patch database type, patch target database, patch SQL feature fields, patch risk level, and patch response action.

[0021] Among them, the patch database type is the database type to which the virtual patch rule applies, the patch target database is the target database to which the virtual patch rule applies, the patch SQL feature field is used to record the SQL access features that need to be protected by the virtual patch rule, the patch risk level indicates the degree of risk when the virtual patch rule is hit, and the patch response action is the action that needs to be taken when the virtual patch rule is hit.

[0022] S2. Reassemble the database access traffic information to obtain the database access session. Based on the database protocol type, parse the database access session and generate the protocol parsing result. Furthermore, the process of reassembling the database access traffic information to obtain a database access session, and then parsing the database access session according to the database protocol type to generate a protocol parsing result, specifically includes: S21. Based on the source address, source port, destination address, destination port, and session time, the data packets are joined and merged to obtain candidate database access sessions; Specifically, after obtaining database access traffic information, the source address, source port, destination address, destination port and session time corresponding to each data packet are read. The source address, source port, destination address and destination port are used as connection merging fields. Data packets with the same connection merging fields are first divided into the same initial data packet set, and then data packets belonging to the same session time range are merged into the same candidate database access session. The session time range refers to the time range determined by the preset session timeout duration. The preset session timeout duration is determined based on the database protocol type and the statistical results of the time interval between adjacent data packets in the same database access session in historical database access traffic. Specifically, data packets marked as belonging to the same database access session in the historical database access traffic are sorted according to session time, the time interval between adjacent data packets is calculated, multiple historical packet interval times are obtained, and the maximum value of multiple historical packet interval times is determined as the preset session timeout duration.

[0023] It is understandable that data packets generated during database access are usually transmitted in a scattered manner, and a single data packet is difficult to fully reflect a database access behavior. Therefore, it is necessary to connect and merge data packets with the same source address, source port, destination address, and destination port and belonging to the same session time range, and to gather multiple data packets in the same database access connection into candidate database access sessions. S22. Based on the database protocol type, organize the data packets in the candidate database access session, generate protocol messages and determine their transmission direction, and divide the protocol messages into request messages and response messages according to the transmission direction of the messages. Specifically, for different database protocol types, based on the correspondence between data packets and protocol messages in their corresponding protocol formats, it is determined whether the data packets in the candidate database access session belong to the same protocol message. Data packets belonging to the same protocol message are concatenated, and the completeness of the concatenated protocol message is determined based on the arrangement and length information of each field in the protocol format. When the protocol message is complete, the fields in the protocol message are sorted to obtain the protocol message. The protocol message sent from the client side to the database side is determined as the request message, and the protocol message returned from the database side to the client side is determined as the response message. When a protocol message is incomplete, the currently assembled data packet is kept in the candidate database access session and will continue to be assembled when subsequent data packets arrive. If a complete protocol message is not formed within the session time range, it will be marked as an incomplete message. Incomplete messages will not participate in the pairing of request and response messages.

[0024] S23. Pair the request and response messages according to the database protocol type to obtain a database access session; Specifically, based on the pairing rules in the protocol format corresponding to the database protocol type used to determine whether request and response messages belong to the same database interaction, request and response messages located in the same candidate database access session are matched. When a match is successful, the request and response messages are treated as a pair. The paired message pairs in the same candidate database access session are combined according to their order in the candidate database access session to obtain the database access session.

[0025] It is understandable that database access behavior typically includes database requests initiated by the client and database responses returned by the database. Individual request or response messages are difficult to fully represent the request and response situation of database access behavior. By pairing request and response messages according to the database protocol type, the request content and response results in the same database interaction can be grouped into the same database access session.

[0026] S24. Determine the session identifier corresponding to the database access session based on the request message corresponding to the database access session; Specifically, when the application forwards a database access request, it writes the session identifier and the application auxiliary identifier from the application session information into the request message corresponding to the database access request. By reading the session identifier carried in the request message corresponding to the database access session and determining the read session identifier as the session identifier corresponding to the database access session, the session identifier corresponding to the database access session and the session identifier in the application session information can have the same source and the same string format.

[0027] S25. Parse the request message to obtain the database user, client information, SQL statement, and request time; Specifically, based on the database protocol type to which the request message belongs, the fields in the request message are parsed, and the information used to represent the login account or execution account is extracted as the database user, the information used to represent the access source is extracted as the client information, the information used to represent the database operation content is extracted as the SQL statement, and the session time corresponding to the request message in the database access session is taken as the request time.

[0028] S26. Perform lexical and syntactic analysis on the SQL statement to generate the SQL syntax structure; Specifically, the SQL statement is lexically segmented to identify keywords, identifiers, operators, constant values, function names, and delimiters. The segmented results are then analyzed according to the SQL syntax rules corresponding to the database type to generate an SQL syntax structure that represents the hierarchical structure of the SQL statement. Keywords include SELECT, INSERT, UPDATE, DELETE, FROM, WHERE, JOIN, GROUP BY, and ORDER BY; identifiers include database names, table names, field names, and aliases; operators include comparison operators, logical operators, and arithmetic operators; constant values ​​include numeric constants, string constants, date constants, Boolean constants, and null constants; function names refer to the names of database functions called in the SQL statement; and delimiters include commas, parentheses, and semicolons.

[0029] It is understandable that we assume the SQL syntax rules used to analyze simple query statements include: When the first non-empty term in the term sequence is the keyword term "SELECT", the corresponding SQL statement will be identified as a query statement; The term range located after the keyword term "SELECT" and before the keyword term "FROM" is taken as the query field range, and the identifier terms separated by the delimiter term "," in this range are identified as query fields. The term interval located after the keyword term "FROM" and before the keyword term "WHERE" is taken as the access table interval, and the identifier term within this interval is identified as the access table object. The range of terms following the keyword term "WHERE" is used as the query condition range, and the query condition expression is identified according to the combination relationship of "left operand term, comparison operator term, and right operand term".

[0030] Taking the SQL statement "SELECT name, phone FROM user_info WHERE id = 123" as an example, based on the above SQL syntax rules, lexical analysis of this SQL statement yields a sequence of terms arranged in the original order. This sequence includes the keyword term "SELECT", the identifier term "name", the delimiter term ",", the identifier term "phone", the keyword term "FROM", the identifier term "user_info", the keyword term "WHERE", the identifier term "id", the comparison operator term "=", and the numeric constant term "123". Since the first non-empty term in this sequence is the keyword "SELECT",... Therefore, according to the first SQL syntax rule, the SQL statement is identified as a query statement, and a query statement root node is generated. According to the second SQL syntax rule, the interval of tokens located after the "SELECT" keyword token and before the "FROM" keyword token is identified as the query field interval. Within the query field interval, the identifier tokens are grouped using the delimiter token "," as the boundary. The resulting identifier tokens "name" and "phone" are identified as query fields, and a query field list node is generated. According to the third SQL syntax rule, the position... The term range following the "FROM" keyword and preceding the "WHERE" keyword is defined as the access table range. The identifier term "user_info" within this range is identified as the access table object, and an access table object node is generated. According to the fourth SQL syntax rule, the term range following the "WHERE" keyword is defined as the query condition range. Within this range, matching is performed in the order of "left operand term, comparison operator term, right operand term." The identifier term "id" to the left of the comparison operator term "=" is identified as the condition. The field defines the comparison operator "=" as the condition operator, and the numeric constant "123" to the right of the comparison operator "=" as the condition value, generating a query condition node. The resulting SQL syntax structure includes a query statement root node, a query field list node, an access table object node, and a query condition node. The query statement root node indicates that the SQL statement is a query statement, the query field list node includes the fields "name" and "phone", the access table object node corresponds to the table "user_info", and the query condition node corresponds to the condition expression "id = 123".

[0031] S27. Extract operation commands, database access, table access, field access, and query conditions according to the SQL syntax structure, and normalize and replace the constant values ​​in the SQL statement to obtain the SQL template. Specifically, based on the keywords and syntactic relationships in the SQL syntax structure, the operation commands, database access, table access, field access, and query conditions corresponding to the SQL statement are extracted. Among them, the operation commands include database operation types such as query, insert, update, delete, create, delete objects, and grant authorization. The database access is used to represent the database object accessed by the SQL statement. The table access is used to represent the data table involved in the SQL statement. The field access is used to represent the data field involved in the SQL statement. The query conditions are used to represent the condition constraints in the SQL statement.

[0032] Furthermore, the constant values ​​in the SQL statement are normalized and replaced according to their type. Numeric constants are replaced with numeric placeholders, string constants with string placeholders, date constants with date placeholders, boolean constants with boolean placeholders, and null constants with null placeholders to obtain the SQL template. For example, after replacing the constant value "1001" in "select name from user_info where id=1001" with a placeholder, the corresponding SQL template is obtained. The SQL template can be used to represent database access behaviors with different parameters but the same structure.

[0033] S28. Determine if a response message exists. If a corresponding response message exists, parse the response message to obtain the number of affected rows and the number of returned rows. Treat the same request message and its corresponding response message as a database access behavior record. Combine the database user, client information, request time, SQL statement, SQL template, operation command, accessed database, accessed table, accessed field, query conditions, and the number of affected rows and returned rows corresponding to this database access behavior record to obtain the protocol parsing result. If no corresponding response message exists, treat a single request message as a database access behavior record. Combine the database user, client information, request time, SQL statement, SQL template, operation command, accessed database, accessed table, accessed field, and query conditions corresponding to this database access behavior record to obtain the protocol parsing result.

[0034] Specifically, after completing the request message parsing and SQL statement analysis, the session identifier of the database access session is used as the identifier of the protocol parsing result. For each database access behavior record, the database user, client information and request time obtained from the request message parsing are first written into the request side field of the database access behavior record, and the SQL statement, SQL template, operation command, accessed database, accessed table, accessed field and query conditions obtained from the SQL statement analysis are written into the SQL semantic field of the database access behavior record.

[0035] Furthermore, determine whether a corresponding response message exists; if a corresponding response message exists, then according to the database protocol type to which the response message belongs, parse the fields in the response message, extract the information used to indicate the number of data rows affected by the SQL operation as the number of affected rows, extract the information used to indicate the number of data rows returned by the query operation as the number of returned rows, write the number of affected rows and the number of returned rows obtained from parsing the response message into the response-side field of the database access behavior record, and encapsulate the request-side field, the SQL semantic field and the response-side field into the same structured parsing record; If no corresponding response message exists, the request-side fields and SQL semantic fields will be encapsulated into the same structured parsing record, excluding the response-side fields. One or more structured parsed records belonging to the same database access session are arranged according to the request time order of their respective request messages to obtain the protocol parsing result. The protocol parsing result is used to represent the protocol layer parsing content of each database access behavior in the database access session.

[0036] S3. Based on application session information and database access session, construct a three-layer associated access record, which includes application access layer fields, database session layer fields, and database operation layer fields; Furthermore, the construction of a three-layer association access record based on application session information and database access session specifically includes: S31. Check if there is a session identifier in the database access session that matches the session identifier in the application session information, and bind the application session information with the matching session identifier to the database access session; Specifically, the session identifier in the application session information is compared with the session identifier corresponding to the database access session. When the session identifier in the application session information is the same as the session identifier in the database access session, it is determined that there is a direct correspondence between the application session information and the database access session. The application session information is then bound to the database access session, and the application account, application address, access URL, access time, and application auxiliary identifier are used as the application layer association information of the database access session.

[0037] S32. For database access sessions and application session information that have not been bound through session identifiers, the application session information whose application address matches the client information corresponding to the database access session is taken as the object to be filtered. The time difference between the access time of the object to be filtered and the request time of the database access session is calculated, and candidate application sessions are generated in order of increasing time difference. Specifically, when the session identifier in the application session information does not match the session identifier in the database access session, the application address, access time and application auxiliary identifier in the application session information, as well as the client information, request time and session identifier corresponding to the database access session, are read. First, the consistency between the application address and the client information is compared. The application session information with the same application address and client information is used as the filter object. Then, the time difference between the access time and request time of the filter object is calculated, and the filter objects are arranged as candidate application sessions in order of increasing time difference. It should be noted that the application-side auxiliary identifier is not used as a condition for determining candidate application sessions on its own. Instead, it is used for priority determination when multiple candidate application sessions have the same time difference or all meet the binding conditions. When multiple application-side auxiliary identifiers exist at the same time, they are matched precisely with the application-side auxiliary identifiers carried in the request message corresponding to the database access session in the order of request number, link tracing identifier, transaction identifier, and gateway forwarding identifier. The candidate application session that is matched first is taken as the candidate application session that is bound first.

[0038] S33. Calculate the time difference between the access time of each successfully bound application session and the request time of the database access session to obtain multiple binding time differences, and set the maximum value of the multiple binding time differences as the association time threshold. Specifically, the time difference between the access time of each group of bound application session information and the request time of the corresponding database access session is calculated to obtain multiple binding time differences. These multiple binding time differences are compared according to their numerical values, and the maximum value is determined as the association time threshold. The association time threshold is used to limit the maximum time deviation allowed between the candidate application session and the database access session.

[0039] It is understandable that there is usually a certain time difference between application-side access requests and database-side access requests. This time difference may be caused by application processing, network transmission, or database connection processing. By statistically analyzing the time difference between successfully bound application sessions and database access sessions, and using the maximum value among multiple binding time differences as the association time threshold, the selection range of subsequent candidate application sessions can be adapted to the actual time deviation in the current database access process.

[0040] S34. Calculate the time difference between the access time of the candidate application session and the request time of the database access session to obtain the candidate time difference. Bind the candidate application session with the database access session whose candidate time difference is less than the associated time threshold and whose application address is consistent with the client information corresponding to the database access session. Specifically, the absolute value of the difference between the access time of the candidate application session and the request time of the database access session is calculated. This absolute value is used as the candidate time difference. The candidate application sessions are ranked in ascending order of their candidate time differences. The candidate time difference of the ranked candidate application session is compared with the associated time threshold. When the candidate time difference is less than the associated time threshold, the candidate application session and the database access session are determined to meet the binding condition in terms of time. At the same time, the application address in the candidate application session is compared with the client information corresponding to the database access session. When the application address and client information are consistent, the candidate application session and the database access session are determined to meet the binding condition in terms of consistency between the application address and client information.

[0041] Furthermore, when a candidate application session simultaneously meets the binding conditions in terms of time and consistency between the application address and client information, the candidate application session is bound to the database access session, and the application account, application address, access URL, access time, and application auxiliary identifier in the candidate application session are used as the application layer association information of the database access session.

[0042] Understandably, when session identifiers cannot be directly matched, the correspondence between candidate application sessions and database access sessions needs to be further confirmed by the consistency of access time, application address, and client information. By first sorting the candidates by time difference and then comparing the time difference of the highest-ranked candidate with the associated time threshold, irrelevant candidate application sessions can be reduced from participating in the binding judgment. By comparing the consistency of application address and client information, application sessions with inconsistent sources can be excluded, thereby improving the accuracy of binding application sessions and database access sessions.

[0043] Furthermore, when the same database access session corresponds to multiple candidate application sessions that meet the binding conditions, the candidate application session with the smallest candidate time difference is selected and bound to the database access session. When the candidate time differences of multiple candidate application sessions are the same, the candidate application session whose application-side auxiliary identifier precisely matches the application-side auxiliary identifier corresponding to the database access session is selected and bound. When the same application session corresponds to multiple database access sessions, binding is performed for each database access session according to the above rules. When the same database access session corresponds to multiple application sessions, the corresponding candidate application sessions are determined according to the request time of the database access behavior record.

[0044] S35. Use the application account, application address, access URL and access time in the bound application session information as application access layer fields, the client information, database user and access database in the protocol parsing result as database session layer fields, and the SQL statement in the protocol parsing result as database operation layer fields to construct a three-layer associated access record including application access layer fields, database session layer fields and database operation layer fields. Specifically, after the application session information is bound to the database access session, the application account, application address, access URL and access time in the bound application session information are read, and the application account, application address, access URL and access time are written into the application access layer field in the three-layer associated access record.

[0045] Furthermore, the client information, database user, and access database in the protocol parsing result are read and written into the database session layer field of the three-layer association access record. The SQL statement in the protocol parsing result is read and written into the database operation layer field of the three-layer association access record. The application access layer field, database session layer field, and database operation layer field are combined to generate the three-layer association access record.

[0046] Among them, the application access layer field is used to indicate the subject and access entry point of the application-side access request, the database session layer field is used to indicate the client source, database user and access database in the database access session, and the database operation layer field is used to indicate the SQL statement actually executed in the database access behavior.

[0047] It is understandable that by constructing a three-layer association access record, application accounts, application access entry points, database users, database access objects, and SQL statements can be associated in the same record, so that when database access behavior characteristics are generated later, application-side access behavior, database session behavior, and database operation behavior can be reflected simultaneously.

[0048] S4. Based on the asset information of the database to be protected and the protocol parsing results, generate the access object characteristics corresponding to the database access behavior; Furthermore, determining the access object characteristics corresponding to the database access behavior based on the database asset information to be protected and the protocol parsing results specifically includes: S41. Based on the target address and target port corresponding to the database access session, find the database to be protected that has the same database address and database port from the database asset information to be protected, and take the found database to be protected as a candidate database to be protected. Match the access database in the protocol parsing result with the candidate database to be protected. When the access database matches a candidate database to be protected, take the candidate database to be protected as the target database. Specifically, based on the target address and target port corresponding to the database access session, the database to be protected with the same database address and database port is searched from the database asset information to be protected. The searched database is used as a candidate database to be protected. The access database in the protocol parsing result is then matched with the candidate database to be protected. When the access database matches a candidate database to be protected, the candidate database to be protected is determined as the database to be protected that the database access behavior needs to access, and the candidate database to be protected is used as the target database.

[0049] It is understandable that the target address and target port can indicate the location of the database service to which the database access behavior is directed, and the accessed database can indicate the database object actually accessed by the SQL statement. Using the two together can improve the accuracy of the target database determination.

[0050] S42. Determine the table object to be accessed based on the access table, and determine the field object to be accessed based on the access fields and the correspondence between the table object and the field object; Specifically, the access table is matched with the table objects in the database table structure corresponding to the target database. When the access table matches a certain table object, that table object is determined as the table object that the database access behavior needs to access.

[0051] Furthermore, the access fields in the protocol parsing result are read, and based on the correspondence between table objects and field objects in the database table structure, the field object that matches the access field is searched in the determined table objects. When the access field matches a certain field object, that field object is determined as the field object that the database access behavior needs to access. When the access field indicates access to all fields in the table, all field objects corresponding to the access table are read according to the database table structure corresponding to the target database, and all field objects corresponding to the access table are determined as the field objects that need to be accessed. When the SQL statement involves multiple access tables, the corresponding table object is determined according to each access table, and the field objects that need to be accessed under each access table are determined according to the access fields corresponding to each access table and the correspondence between table objects and field objects.

[0052] S43. Based on the sensitive field information in the asset information of the database to be protected, determine whether the field object to be accessed is a sensitive field. If the field object to be accessed is a sensitive field, then the accessed field is determined to be a sensitive field, a corresponding sensitive field tag is generated, and the corresponding sensitivity level is determined according to the correspondence between sensitive fields and sensitivity levels. If the field object to be accessed is not a sensitive field, then the accessed field is determined to be a non-sensitive field, and the corresponding sensitive field tag is determined to be a non-sensitive tag. Specifically, the field object to be accessed is compared with the sensitive fields in the sensitive field information. When the field object to be accessed matches a sensitive field, the field object is determined to be a sensitive field, and the sensitive field mark of the corresponding accessed field is set to a sensitive mark. When the field object to be accessed is a sensitive field, the sensitivity level corresponding to the sensitive field is read according to the correspondence between sensitive fields and sensitivity levels in the sensitive field information, and the read sensitivity level is used as the sensitivity level corresponding to the accessed field. When the field object to be accessed does not match any of the sensitive fields in the sensitive field information, the field object is determined not to be a sensitive field, and the sensitive field mark of the corresponding accessed field is set to a non-sensitive mark. When the corresponding accessed field is a non-sensitive field, the sensitivity level field corresponding to the accessed field is set to empty.

[0053] Understandably, by comparing access fields with sensitive field information, it is possible to identify whether database access behavior involves personal identity information, account information, transaction information, core business information, or other data fields that require special protection, and the sensitivity level reflects the degree of data sensitivity corresponding to the access fields.

[0054] S44. Combine the target database, access table, access field, sensitive field marker, and sensitivity level into access object characteristics.

[0055] Specifically, after determining the target database, access table, access field, sensitive field marker, and sensitivity level, the target database, access table, access field, sensitive field marker, and sensitivity level are written into the same structured feature record to obtain the access object feature. When the database access behavior involves multiple access tables or multiple access fields, the sensitive field marker and sensitivity level corresponding to each access table and each access field are generated respectively, and each access table, each access field, each sensitive field marker, and each sensitivity level are written into the access object feature.

[0056] S5. Based on the protocol parsing results, the three-layer association access records, and the access object characteristics, generate database access behavior characteristics, which include access subject characteristics, SQL semantic characteristics, access time characteristics, access frequency characteristics, and sensitive data access characteristics; Furthermore, the generation of database access behavior characteristics based on the protocol parsing results, the three-layer association access records, and the characteristics of the accessed object specifically includes: S51. Use the application account and application address, client information and database user in the three-level association access record as access subject characteristics; It is understandable that the access subject characteristics include both application-side subject information and database-side subject information, which can reflect the correspondence between application accounts and database users.

[0057] S52. The SQL statements, SQL templates, operation commands, query conditions, number of affected rows, and number of returned rows in the protocol parsing results shall be used as SQL semantic features; S53. Use the access time in the three-level associated access records as the access time feature; It should be noted that when the same database access session contains multiple database access behavior records, the access time corresponding to each database access behavior record is read separately, and the access time feature corresponding to each database access behavior record is generated separately.

[0058] S54. The same access subject is defined as the same access subject, and the same target database, access table and access field are defined as the same access object. The first request time to the last request time of each database access session is defined as the statistical range of the database access session. The number of times the same access subject accesses the same access object within the statistical range is counted, and the number of accesses is used as the access frequency feature. It is understandable that each database access session has a corresponding request time range. Using the above request time range as the statistical range can avoid inconsistencies in the statistical caliber of access counts caused by different database access session times. The access frequency characteristics can reflect the intensity of access to the same access object by the same access subject in the same database access session. When the number of accesses increases abnormally, it can serve as the basis for subsequent access control rule matching and risk assessment.

[0059] S55. When the sensitive field marker in the access object feature indicates that the access field belongs to a sensitive field, the access field, the sensitive field marker, and the sensitivity level shall be used as sensitive data access features. When the sensitive field marker in the access object feature indicates that the access field does not belong to a sensitive field, the access field and the non-sensitive marker shall be used as sensitive data access features. Understandably, sensitive data access characteristics are used to indicate whether database access behavior involves sensitive data and the degree of sensitivity of the involved sensitive data, providing a basis for subsequent access control rule matching, risk level determination, and response action determination.

[0060] S56. Combine the characteristics of the access subject, the access object, the SQL semantic characteristics, the access time characteristics, the access frequency characteristics, and the sensitive data access characteristics to obtain the database access behavior characteristics.

[0061] Specifically, the access subject characteristics, access object characteristics, SQL semantic characteristics, access time characteristics, access frequency characteristics, and sensitive data access characteristics are encapsulated into the same structured feature record to obtain database access behavior characteristics. When there are multiple database access behavior records in the same database access session, corresponding database access behavior characteristics are generated for each database access behavior record.

[0062] S6. Match the database access behavior characteristics with the set of protection rules to obtain the rule hit results, and determine the risk level of the database access behavior and the final response action based on the rule hit results; Furthermore, the process of matching database access behavior characteristics with a set of protection rules to obtain rule hit results, and determining the risk level of the database access behavior and the final response action based on the rule hit results, specifically includes: S61. Match database access behavior characteristics with a trusted access whitelist; If the application account, database user, target database, access table, access field, and SQL template in the database access behavior characteristics are consistent with the template application account, template database user, template target database, template access table, template access field, and template SQL template in the template whitelist, and the access time in the access time characteristics is within the template access time range in the template whitelist, then the database access behavior is determined to hit the template whitelist. If the SQL statement, database user, client information, and target database in the database access behavior characteristics are consistent with the trusted SQL statement, trusted database user, trusted client information, and trusted target database in the statement whitelist, and the database type corresponding to the target database in the database asset information to be protected is consistent with the trusted database type in the statement whitelist, then the database access behavior is determined to have hit the statement whitelist. When a database access behavior matches at least one of the template whitelist and statement whitelist, a trusted behavior match result is generated. Understandably, template whitelists are used to identify trusted database access behaviors with the same structure and variable parameters, while statement whitelists are used to identify complete trusted SQL statements explicitly configured by the administrator. By matching template whitelists and statement whitelists together, both automatically learned trusted access behaviors and manually configured precise trusted access behaviors can be taken into account.

[0063] S62. Match the access subject characteristics, access object characteristics, access time characteristics, access frequency characteristics, and sensitive data access characteristics with the access control rules. When the access subject characteristics are consistent with the control subject field, the access object characteristics are consistent with the control object field, and the access time characteristics are inconsistent with the control time field, the access frequency characteristics reach the access frequency threshold, or the sensitivity level of the sensitive data access characteristics reaches the sensitivity level threshold, the database access behavior is determined to have hit the access control rules, and an access control hit result is generated. Specifically, the application account, application address, client information, and database user in the access subject characteristics are matched with the control subject field in the access control rules. The target database, access table, and access field in the access object characteristics are matched with the control object field in the access control rules. When the access subject characteristics and the access object characteristics are consistent, the access time characteristics, access frequency characteristics, and sensitive data access characteristics are matched with the control time field, access count threshold, and sensitivity level threshold in the access control rules, respectively. When the access time in the access time characteristics does not meet the time conditions limited by the control time field, the access time abnormality condition is determined to be met. When the access count in the access frequency characteristics reaches the access count threshold, the access frequency abnormality condition is determined to be met. When the sensitivity level in the sensitive data access characteristics reaches the sensitivity level threshold, the sensitive data access condition is determined to be met. Furthermore, when at least one of the abnormal access time condition, abnormal access frequency condition, and sensitive data access condition is met, it is determined that the database access behavior has hit the access control rule, an access control hit result is generated, and the hit access control rule, access control risk level, and access control response action are recorded.

[0064] S63. Match SQL semantic features with attack feature rules. When at least one of the SQL statement, SQL template, operation command and query condition in the SQL semantic features matches the attack SQL feature field recorded in the attack feature rule, determine that the database access behavior hits the attack feature rule, and generate an attack feature hit result according to the attack feature type recorded in the attack feature rule. Specifically, the SQL statement, SQL template, operation command, and query condition in the SQL semantic features are matched with the attack SQL feature fields in the attack feature rules. When at least one of the SQL statement, SQL template, operation command, and query condition matches the attack SQL feature field, the database access behavior is determined to have hit the attack feature rule. The attack feature type, attack risk level, and attack response action in the attack feature rule are then read and written into the attack feature hit result.

[0065] S64. Based on the SQL semantic features, access object features, and the database type corresponding to the target database in the database asset information to be protected, determine whether the database access behavior hits the virtual patching rule. When the database type is consistent with the patch database type, the target database is consistent with the patch target database, and at least one of the SQL statement, SQL template, operation command, and query condition in the SQL semantic features meets the patch SQL feature field, and at least one of the access table and access field in the access object features meets at least one of the patch SQL feature fields, the database access behavior is determined to hit the virtual patching rule, and a virtual patch hit result is generated. Specifically, the database type corresponding to the target database is compared with the patch database type, and the target database is compared with the patch target database. When the database type and patch database type are consistent, and the target database and patch target database are consistent, the SQL semantic features and access object features are matched with the patch SQL feature fields. The SQL statement, SQL template, operation command, and query condition in the SQL semantic features are matched with the patch SQL feature fields, and the access table and access field in the access object features are matched with the patch SQL feature fields. When at least one of the SQL statement, SQL template, operation command, and query condition matches the patch SQL feature field, or at least one of the access table and access field matches the patch SQL feature field, the database access behavior is determined to have hit the virtual patch rule, a virtual patch hit result is generated, and the hit virtual patch rule, patch risk level, and patch response action are recorded.

[0066] Understandably, virtual patching rules are used to identify and intercept corresponding SQL access characteristics at the protocol layer when the database itself has not completed patch deployment or when the database has specific dangerous SQL access risks, thereby achieving pre-emptive protection against database access behavior.

[0067] S65. Combine the generated trusted behavior hit results, access control hit results, attack signature hit results, and virtual patch hit results into a rule hit result; Specifically, trusted behavior hit results, access control hit results, attack signature hit results, and virtual patch hit results are written into the same rule hit record according to the rule type to generate rule hit results.

[0068] Furthermore, when the rule hit results only include trusted behavior hit results and do not include access control hit results, attack signature hit results, and virtual patch hit results, the risk level of the database access behavior is determined to be low risk, and the final response action of the database access behavior is determined to be allowed. When the rule hit result includes at least one of the following: access control hit result, attack feature hit result, or virtual patch hit result, the risk level of the database access behavior is determined based on the access control risk level in the hit access control rule, the attack risk level in the hit attack feature rule, the patch risk level in the hit virtual patch rule, and the sensitivity level in the access object feature. Specifically, when the rule hit results include multiple risk levels, the highest risk level is selected as the initial risk level. When the sensitivity level of the accessed object characteristics reaches the sensitivity level threshold, the risk level of the database access behavior is determined to be no lower than the initial risk level.

[0069] Furthermore, when the rule hit results do not include trusted behavior hit results, access control hit results, attack signature hit results, and virtual patch hit results, the database access behavior is determined to have not hit the protection rule set, the risk level of the database access behavior is determined to be low risk, the final response action of the database access behavior is determined to be allowed, and the database access behavior is written to the audit log.

[0070] S66. Based on the access control response action in the hit access control rule, the attack response action in the hit attack feature rule, and the patch response action in the hit virtual patch rule, determine the candidate response action, which includes session blocking, statement interception, and alarm recording. When the same database access behavior corresponds to multiple candidate response actions, the candidate response action with the highest action intensity is determined as the final response action in the order of action intensity: session blocking, statement interception, and alarm recording.

[0071] Specifically, when the rule hit result includes an access control hit result, the access control response action in the hit access control rule is read and used as a candidate response action. When the rule hit result includes an attack signature hit result, the attack response action in the hit attack signature rule is read and used as a candidate response action. When the rule hit result includes a virtual patch hit result, the patch response action in the hit virtual patch rule is read and used as a candidate response action.

[0072] Furthermore, when the same database access behavior corresponds to a candidate response action, the candidate response action is determined as the final response action. When the same database access behavior corresponds to multiple candidate response actions, the candidate response action with the highest action intensity is determined as the final response action in the order of action intensity: session blocking, statement interception, and alarm recording.

[0073] Session blocking interrupts database access sessions, statement blocking prevents SQL statements from being sent to the database to be protected, and alarm logging records risks and generates alarm information. Session blocking has a higher action intensity than statement blocking, and statement blocking has a higher action intensity than alarm logging.

[0074] It is understandable that the same database access behavior may simultaneously hit multiple rules in access control rules, attack signature rules, and virtual patch rules. By determining the final response action according to the order of action strength, it can be ensured that the action with higher protection strength is executed first when multiple rules are hit.

[0075] S7. Perform security measures on database access behavior according to the final response action, and generate corresponding risk logs and audit logs based on the security measures results.

[0076] Furthermore, the process of performing security measures on database access behavior according to the final response action, and generating corresponding risk logs and audit logs based on the security measures results, specifically includes: S71. When the final response action is to allow access, forward the database access behavior to the database to be protected, generate an allow handling result, and generate an audit log based on the allow handling result; Specifically, when the final response action is to allow, the database access behavior is allowed to continue, the request message or SQL statement corresponding to the database access behavior is forwarded to the database to be protected, and the response result returned by the database to be protected is received. The allowance processing result is generated, and the allowance processing result is combined with the access time, source address, application account, access URL, database user, target database, SQL statement, SQL template, operation command, access table and access field corresponding to the database access behavior to generate an audit log.

[0077] S72. When the final response action is an alarm record, forward the database access behavior to the database to be protected, generate alarm records and alarm handling results, and generate risk logs and audit logs based on the alarm records and alarm handling results; Specifically, when the final response action is an alarm record, the database access behavior is allowed to continue to execute, the request message or SQL statement corresponding to the database access behavior is forwarded to the database to be protected, and an alarm record is generated based on the rule hit result, risk level and final response action. After the database access behavior is forwarded, the handling status of the database access behavior is recorded, an alarm handling result is generated, and a risk log and an audit log are generated based on the alarm record and the alarm handling result. Among them, the risk log is used to record the risk level, hit rules, final response actions and security handling results of the database access behavior, while the audit log is used to record the access process, access subject, access object and SQL semantic characteristics of the database access behavior.

[0078] S73. When the final response action is statement interception, prevent the SQL statement in the protocol parsing result from being sent to the database to be protected, generate the interception and handling result, and generate risk logs and audit logs based on the interception and handling result; Specifically, when the final response action is statement interception, the SQL statement that needs to be intercepted is determined based on the protocol parsing result, and the SQL statement is prevented from being sent to the database to be protected, so that the SQL statement is not executed by the database to be protected.

[0079] Furthermore, the intercepted SQL statements, corresponding database access sessions, hit rules, risk levels, and interception status are recorded, interception and handling results are generated, and risk logs and audit logs are generated based on the interception and handling results.

[0080] Understandably, statement interception only targets the currently hit SQL statement and does not interrupt other database access behaviors in the same database access session.

[0081] S74. When the final response action is session blocking, interrupt the corresponding database access session, prevent subsequent database access behaviors in the database access session from continuing to be executed, generate blocking handling results, and generate risk logs and audit logs based on the blocking handling results; Specifically, when the final response action is session blocking, the corresponding database access session is determined based on the session identifier corresponding to the database access behavior, and the database access session is interrupted, so that subsequent database access behaviors in the database access session cannot continue to be executed.

[0082] Furthermore, the system records the blocked database access sessions, corresponding application accounts, client information, database users, target databases, hit rules, risk levels, and blocking status, generates blocking handling results, and generates risk logs and audit logs based on the blocking handling results.

[0083] The risk log and audit log include access time, source address, application account, access URL, database user, target database, SQL statement, SQL template, operation command, access table, access field, risk level, hit rule, final response action and security handling result.

[0084] Furthermore, the risk log is used to record database access behaviors that pose a risk or trigger security actions, while the audit log is used to record the access process and handling process of database access behaviors. When the final response action is to allow access, an audit log is generated; when the final response action is to record an alarm, block a statement, or block a session, both a risk log and an audit log are generated.

[0085] Reference Figure 6 As shown, a network security protection system based on database protocol analysis is used to implement the network security protection method based on database protocol analysis as described in any of the preceding claims, comprising: The data acquisition module is used to acquire database access traffic information, database asset information to be protected, application session information, and protection rule set. Specifically, the data acquisition module collects database access traffic information generated during database access, database asset information corresponding to the database to be protected, application session information generated by the application side, and a set of protection rules for rule matching, and sends the collected data to the data processing module and the data analysis module.

[0086] The data processing module is used to reassemble the database access traffic information to obtain the database access session, parse the database access session according to the database protocol type and generate the protocol parsing result, and build a three-layer association access record based on the application session information and the database access session. Specifically, the data processing module receives database access traffic information and application session information sent by the data acquisition module. It performs connection and merging, protocol message organization, request and response message pairing, and session identifier generation on the data packets in the database access traffic information to obtain the database access session. Then, it parses the database access session according to the database protocol type to obtain the protocol parsing result. Subsequently, based on the session identifier, access time, application address, client information, and application auxiliary identifier between the application session information and the database access session, it constructs a three-layer association access record.

[0087] The data analysis module is used to generate access object characteristics corresponding to database access behavior based on the asset information of the database to be protected and the protocol parsing results. Based on the protocol parsing results, the three-layer associated access records and access object characteristics, database access behavior characteristics are generated. The database access behavior characteristics are matched with the set of protection rules to obtain the rule hit results. Based on the rule hit results, the risk level of the database access behavior and the final response action are determined. Specifically, the data analysis module receives the protocol parsing results and three-layer association access records generated by the data processing module, and receives the database asset information to be protected and the set of protection rules collected by the data acquisition module. Based on the access database, access table and access field in the protocol parsing results, the data analysis module determines the target database, table object, field object, sensitive field marker and sensitivity level from the database asset information to be protected, and generates access object characteristics. Then, based on the protocol parsing results, three-layer association access records and access object characteristics, it generates database access behavior characteristics. Subsequently, it matches the database access behavior characteristics with the set of protection rules to obtain the rule hit results, and determines the risk level and final response action based on the rule hit results.

[0088] The execution module is used to perform security measures on database access behavior according to the final response action, and generate corresponding risk logs and audit logs based on the security measures results.

[0089] Specifically, the execution module receives the final response action determined by the data analysis module, and performs corresponding actions such as allowing access, recording alarms, blocking statements, or blocking sessions on the database access behavior based on the final response action. After completing the actions, the execution module generates risk logs and audit logs based on the security action results.

[0090] Furthermore, the data processing module includes: A session unit is used to reassemble database access traffic information into a session and generate a session identifier corresponding to the database access session. Specifically, the session unit connects and merges data packets based on the source address, source port, destination address, destination port, and session time in the database access traffic information to obtain candidate database access sessions. According to the database protocol type, it organizes the data packets in the candidate database access sessions, generates protocol messages, and divides them into request messages and response messages. Based on the pairing results of request messages and response messages, it obtains the database access session and generates the session identifier corresponding to the database access session.

[0091] The parsing unit is used to parse the database access session according to the database protocol type and generate the protocol parsing result. Specifically, the parsing unit parses the request messages in the database access session according to the database protocol type, obtaining the database user, client information, SQL statement, and request time; it performs lexical and syntactic analysis on the SQL statement to generate the SQL syntax structure; it extracts the operation commands, database access, table access, field access, and query conditions from the SQL syntax structure, and normalizes and replaces the constant values ​​in the SQL statement to obtain the SQL template; it determines whether a corresponding response message exists. If a corresponding response message exists, it parses the response message to obtain the number of affected rows and the number of returned rows, and combines the database user, client information, request time, SQL statement, SQL template, operation commands, database access, table access, field access, query conditions, number of affected rows, and number of returned rows into the protocol parsing result; if no corresponding response message exists, it combines the database user, client information, request time, SQL statement, SQL template, operation commands, database access, table access, field access, and query conditions into the protocol parsing result.

[0092] The association unit is used to construct a three-tiered association access record based on application session information and database access session; Specifically, the association unit searches for a session identifier in the database access session that matches the session identifier in the application session information. Application session information with matching session identifiers is bound to the database access session. For database access sessions and application session information that are not bound by session identifier, candidate application sessions are filtered based on application address, access time, application auxiliary identifier, and client information corresponding to the database access session. The binding of candidate application sessions is determined based on the candidate time difference and the consistency between application address and client information. After binding is completed, the association unit constructs a three-layer association access record including application access layer fields, database session layer fields, and database operation layer fields.

[0093] Furthermore, the data analysis module includes: The feature unit is used to generate access object features based on the asset information of the database to be protected and the protocol parsing results, and to generate database access behavior features based on the protocol parsing results, the three-layer association access records and the access object features; Specifically, the feature unit determines the target database, table object, and field object from the database asset information to be protected based on the access database, access table, and access field in the protocol parsing results. It also determines the sensitive field markers and sensitivity levels based on the sensitive field information, generating access object features. Subsequently, the feature unit generates access subject features, SQL semantic features, access time features, access frequency features, and sensitive data access features based on the three-layer associated access records and protocol parsing results. Finally, the feature unit combines the access subject features, access object features, SQL semantic features, access time features, access frequency features, and sensitive data access features into database access behavior features.

[0094] The strategy unit is used to match database access behavior characteristics with the set of protection rules to obtain rule hit results, and determine the risk level of database access behavior and the final response action based on the rule hit results; Specifically, the strategy unit matches database access behavior characteristics with trusted access whitelists, access control rules, attack feature rules, and virtual patch rules respectively, generating trusted behavior hit results, access control hit results, attack feature hit results, and virtual patch hit results. These results are then combined into rule hit results. The strategy unit determines the risk level of the database access behavior and the final response action based on the risk level in the rule hit results, the sensitivity level in the access object characteristics, and the response action.

[0095] Furthermore, the execution module includes: The processing unit is used to perform corresponding processing of database access behavior, such as allowing access, recording alarms, blocking statements, and blocking sessions, according to the final response action. Specifically, when the final response action is to allow access, the handling unit forwards the database access behavior to the database to be protected. When the final response action is to record an alarm, the handling unit forwards the database access behavior to the database to be protected and generates an alarm record. When the final response action is to block a statement, the handling unit prevents the SQL statement in the protocol parsing result from being sent to the database to be protected. When the final response action is to block a session, the handling unit interrupts the corresponding database access session and prevents subsequent database access behaviors in that database access session from continuing to execute.

[0096] The audit unit is used to generate corresponding risk logs and audit logs based on the results of security actions. Specifically, the audit unit generates audit logs based on the release handling results, and generates risk logs and audit logs based on the alarm handling results, interception handling results, or blocking handling results.

[0097] The maintenance unit is used to update the trusted access whitelist, access control rules, attack signature rules, and virtual patch rules based on the administrator's feedback on the handling of risk logs and audit logs, and to generate alarm information based on the risk level, final response action, target database, application account, and source address in the risk log.

[0098] Specifically, the maintenance unit receives feedback from the administrator regarding the handling of risk logs and audit logs. When the feedback indicates that a database access behavior is a trusted access behavior, the trusted access whitelist is updated based on the application account, database user, target database, accessed table, accessed field, SQL template, and access time corresponding to the database access behavior. When the feedback indicates that a database access behavior needs to be restricted, the access control rules are updated based on the access subject characteristics, access object characteristics, access time characteristics, access frequency characteristics, and sensitive data access characteristics corresponding to the database access behavior. When the feedback indicates that a database access behavior is an attack behavior, the attack feature rules are updated based on the SQL semantic characteristics corresponding to the database access behavior. When the feedback indicates that a database access behavior needs to be protected by virtual patching, the virtual patching rules are updated based on the database type, target database, and SQL semantic characteristics corresponding to the database access behavior.

[0099] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the claimed invention. The scope of protection of the present invention is defined by the appended claims and their equivalents.

Claims

1. A network security protection method based on database protocol analysis, characterized in that, include: The system acquires database access traffic information, database asset information to be protected, application session information, and a set of protection rules. The database access traffic information includes data packets, source address, source port, destination address, destination port, session time, and database protocol type. The database access traffic information is reassembled to obtain the database access session. Based on the database protocol type, the database access session is parsed and the protocol parsing result is generated. Based on application session information and database access session, a three-layer association access record is constructed, which includes application access layer fields, database session layer fields, and database operation layer fields. Based on the database asset information to be protected and the protocol parsing results, generate access object characteristics corresponding to database access behavior; Based on the protocol parsing results, the three-layer association access records, and the characteristics of the accessed objects, database access behavior characteristics are generated. These database access behavior characteristics include access subject characteristics, SQL semantic characteristics, access time characteristics, access frequency characteristics, and sensitive data access characteristics. The database access behavior characteristics are matched with the set of protection rules to obtain the rule hit results. Based on the rule hit results, the risk level of the database access behavior and the final response action are determined. The database access behavior is handled securely according to the final response action, and corresponding risk logs and audit logs are generated based on the security handling results.

2. The network security protection method based on database protocol analysis according to claim 1, characterized in that, The process of reassembling database access traffic information to obtain a database access session, parsing the database access session according to the database protocol type, and generating a protocol parsing result specifically includes: Based on the source address, source port, destination address, destination port, and session time, data packets are joined and merged to obtain candidate database access sessions; Based on the database protocol type, the data packets in the candidate database access sessions are organized, protocol messages are generated, and their transmission direction is determined. Based on the transmission direction of the messages, the protocol messages are divided into request messages and response messages. Based on the database protocol type, request and response messages are paired to obtain a database access session; The session identifier corresponding to the database access session is determined based on the request message corresponding to the database access session. The request message is parsed to obtain the database user, client information, SQL statement, and request time; Perform lexical and syntactic analysis on SQL statements to generate SQL syntax structure; Extract operation commands, database access, table access, field access, and query conditions from the SQL syntax structure, and normalize and replace the constant values ​​in the SQL statement to obtain the SQL template. Determine if a response message exists. If a corresponding response message exists, parse the response message to obtain the number of rows affected and the number of rows returned. Treat the same request message and its corresponding response message as a database access behavior record. If no corresponding response message exists, each request message is recorded as a database access behavior record. If a response message exists, the database user, client information, request time, SQL statement, SQL template, operation command, database access, table access, field access, query conditions, number of affected rows and number of returned rows corresponding to the database access behavior record are combined to obtain the protocol parsing result; If no response message is found, the database user, client information, request time, SQL statement, SQL template, operation command, database access, table access, access field access, and query conditions corresponding to the database access behavior record are combined to obtain the protocol parsing result.

3. The network security protection method based on database protocol analysis according to claim 1, characterized in that, The construction of a three-layer association access record based on application session information and database access session specifically includes: Check if there is a session identifier in the database access session that matches the session identifier in the application session information, and bind the application session information with the matching session identifier to the database access session; For database access sessions and application session information that have not been bound through session identifiers, the application session information whose application address matches the client information corresponding to the database access session is used as the filtering object. The time difference between the access time of the filtering object and the request time of the database access session is calculated, and candidate application sessions are generated in order of increasing time difference. Calculate the time difference between the access time of each successfully bound application session and the request time of the database access session to obtain multiple binding time differences, and set the maximum value of the multiple binding time differences as the association time threshold. Calculate the time difference between the access time of the top-ranked candidate application session and the request time of the database access session to obtain the candidate time difference. Bind the candidate application session with the database access session to the application address that is less than the associated time threshold and whose application address is consistent with the client information corresponding to the database access session. The application account, application address, access URL, and access time from the bound application session information are used as application access layer fields; the client information, database user, and accessed database from the protocol parsing result are used as database session layer fields; and the SQL statement from the protocol parsing result is used as database operation layer fields. A three-layer associated access record including application access layer fields, database session layer fields, and database operation layer fields is constructed.

4. The network security protection method based on database protocol analysis according to claim 1, characterized in that, The step of determining the access object characteristics corresponding to the database access behavior based on the database asset information to be protected and the protocol parsing results specifically includes: Based on the target address and target port corresponding to the database access session, search for the database to be protected that has the same database address and database port from the database asset information to be protected, and use the found database to be protected as a candidate database to be protected. Match the access database in the protocol parsing result with the candidate database to be protected. When the access database matches a candidate database to be protected, use the candidate database to be protected as the target database. The table object to be accessed is determined based on the access table, and the field object to be accessed is determined based on the access fields and the correspondence between the table object and the field object. Based on the sensitive field information in the asset information of the database to be protected, it is determined whether the field object to be accessed is a sensitive field. If the field object to be accessed is a sensitive field, the accessed field is determined to be a sensitive field, a corresponding sensitive field tag is generated, and the corresponding sensitivity level is determined according to the correspondence between sensitive fields and sensitivity levels in the sensitive field information. If the field object to be accessed is not a sensitive field, the accessed field is determined to be a non-sensitive field, and the corresponding sensitive field tag is determined to be a non-sensitive tag. Combine the target database, access table, access field, sensitive field markers, and sensitivity level into access object characteristics.

5. The network security protection method based on database protocol analysis according to claim 1, characterized in that, The process of generating database access behavior characteristics based on protocol parsing results, three-layer association access records, and access object characteristics specifically includes: The application account and application address, client information and database user in the three-layer association access record are used as access subject characteristics; The SQL statements, SQL templates, operation commands, query conditions, number of affected rows, and number of returned rows in the protocol parsing results are used as SQL semantic features; Use the access time in the three-level associated access records as the access time feature; The same access subject is defined as the same access subject, and the same target database, access table and access field are defined as the same access object. The statistical range of each database access session is from the first request time to the last request time. The number of times the same access subject accesses the same access object within the statistical range is counted and the number of times is used as the access frequency feature. When the sensitive field marker in the access object feature indicates that the access field belongs to a sensitive field, the access field, the sensitive field marker, and the sensitivity level are used as sensitive data access features. When the sensitive field marker in the access object feature indicates that the access field does not belong to a sensitive field, the access field and the non-sensitive marker are used as sensitive data access features. The database access behavior features are obtained by combining the access subject features, access object features, SQL semantic features, access time features, access frequency features, and sensitive data access features. When there are multiple database access behavior records in the same database access session, corresponding database access behavior features are generated for each database access behavior record.

6. The network security protection method based on database protocol analysis according to claim 1, characterized in that, The process of matching database access behavior characteristics with a set of protection rules to obtain rule hit results, and determining the risk level of the database access behavior and the final response action based on the rule hit results, specifically includes: Match database access behavior characteristics with the trusted access whitelist in the protection rule set; If the application account, database user, target database, access table, access field, and SQL template in the database access behavior characteristics are consistent with the template application account, template database user, template target database, template access table, template access field, and template SQL template in the template whitelist of the trusted access whitelist, and the access time in the access time characteristics is within the template access time range in the template whitelist, then the database access behavior is determined to hit the template whitelist. If the SQL statement, database user, client information, and target database in the database access behavior characteristics are consistent with the trusted SQL statement, trusted database user, trusted client information, and trusted target database in the trusted access whitelist, and the database type corresponding to the target database in the database asset information to be protected is consistent with the trusted database type in the statement whitelist, then the database access behavior is determined to have hit the statement whitelist. When a database access behavior matches at least one of the template whitelist and statement whitelist, a trusted behavior match result is generated. The access subject characteristics, access object characteristics, access time characteristics, access frequency characteristics, and sensitive data access characteristics are matched with the access control rules in the protection rule set. When the access subject characteristics are consistent with the control subject field, the access object characteristics are consistent with the control object field, and the access time characteristics are inconsistent with the control time field, the access frequency characteristics reach the access frequency threshold, and the sensitivity level of the sensitive data access characteristics reaches the sensitivity level threshold, the database access behavior is determined to have hit the access control rule, and an access control hit result is generated. The SQL semantic features are matched with the attack feature rules in the protection rule set. When at least one of the SQL statement, SQL template, operation command and query condition in the SQL semantic features matches the attack SQL feature field recorded in the attack feature rule, the database access behavior is determined to hit the attack feature rule, and an attack feature hit result is generated according to the attack feature type recorded in the attack feature rule. Based on the SQL semantic features, access object features, and the database type corresponding to the target database in the database asset information to be protected, it is determined whether the database access behavior hits the virtual patch rule in the protection rule set. When the database type is consistent with the patch database type, the target database is consistent with the patch target database, and at least one of the SQL statement, SQL template, operation command, and query condition in the SQL semantic features meets the patch SQL feature field, and at least one of the access table and access field in the access object features meets at least one of the patch SQL feature fields, it is determined that the database access behavior hits the virtual patch rule, and a virtual patch hit result is generated. The generated trusted behavior hit results, access control hit results, attack signature hit results, and virtual patch hit results are combined into rule hit results; When the rule hit results only include trusted behavior hit results and do not include access control hit results, attack signature hit results, and virtual patch hit results, the risk level of the database access behavior is determined to be low risk, and the final response action of the database access behavior is determined to be allowed. When the rule hit result includes at least one of the following: access control hit result, attack feature hit result, or virtual patch hit result, the risk level of the database access behavior is determined based on the access control risk level in the hit access control rule, the attack risk level in the hit attack feature rule, the patch risk level in the hit virtual patch rule, and the sensitivity level in the access object feature. Based on the access control response action in the hit access control rule, the attack response action in the hit attack feature rule, and the patch response action in the hit virtual patch rule, candidate response actions are determined. The candidate response actions include session blocking, statement interception, and alarm recording. When the same database access behavior corresponds to multiple candidate response actions, the candidate response action with the highest action intensity is determined as the final response action in the order of action intensity: session blocking, statement interception, and alarm recording.

7. The network security protection method based on database protocol analysis according to claim 1, characterized in that, The process of performing security measures on database access behavior according to the final response action, and generating corresponding risk logs and audit logs based on the security measures results, specifically includes: When the final response action is to allow access, the database access behavior is forwarded to the database to be protected, an allowance processing result is generated, and an audit log is generated based on the allowance processing result; When the final response action is alarm recording, the database access behavior is forwarded to the database to be protected, alarm records and alarm handling results are generated, and risk logs and audit logs are generated based on the alarm records and alarm handling results; When the final response action is statement interception, prevent the SQL statement in the protocol parsing result from being sent to the database to be protected, generate the interception and handling result, and generate risk logs and audit logs based on the interception and handling result; When the final response action is session blocking, the corresponding database access session is interrupted, preventing subsequent database access behaviors in the database access session from continuing to be executed, and a blocking handling result is generated. Risk logs and audit logs are generated based on the blocking handling result. The risk log and audit log include access time, source address, application account, access URL, database user, target database, SQL statement, SQL template, operation command, access table, access field, risk level, hit rule, final response action and security handling result.

8. A network security protection system based on database protocol analysis, used to implement the network security protection method based on database protocol analysis as described in any one of claims 1-7, characterized in that, include: The data acquisition module is used to acquire database access traffic information, database asset information to be protected, application session information, and protection rule set. The data processing module is used to reassemble the database access traffic information to obtain the database access session, parse the database access session according to the database protocol type and generate the protocol parsing result, and build a three-layer association access record based on the application session information and the database access session. The data analysis module is used to generate access object characteristics corresponding to database access behavior based on the asset information of the database to be protected and the protocol parsing results. Based on the protocol parsing results, the three-layer associated access records and access object characteristics, database access behavior characteristics are generated. The database access behavior characteristics are matched with the set of protection rules to obtain the rule hit results. Based on the rule hit results, the risk level of the database access behavior and the final response action are determined. The execution module is used to perform security measures on database access behavior according to the final response action, and generate corresponding risk logs and audit logs based on the security measures results.

9. A network security protection system based on database protocol analysis according to claim 8, characterized in that, The data processing module includes: A session unit is used to reassemble database access traffic information into a session and generate a session identifier corresponding to the database access session. The parsing unit is used to parse the database access session according to the database protocol type and generate the protocol parsing result. The association unit is used to construct a three-tiered association access record based on application session information and database access session; The data analysis module includes: The feature unit is used to generate access object features based on the asset information of the database to be protected and the protocol parsing results, and to generate database access behavior features based on the protocol parsing results, the three-layer association access records and the access object features; The strategy unit is used to match database access behavior characteristics with the set of protection rules to obtain rule hit results, and determine the risk level of database access behavior and the final response action based on the rule hit results.

10. A network security protection system based on database protocol analysis according to claim 8, characterized in that, The execution module includes: The processing unit is used to perform corresponding processing of database access behavior, such as allowing access, recording alarms, blocking statements, and blocking sessions, according to the final response action. The audit unit is used to generate corresponding risk logs and audit logs based on the results of security actions. The maintenance unit is used to update the trusted access whitelist, access control rules, attack signature rules, and virtual patch rules based on the administrator's feedback on the handling of risk logs and audit logs, and to generate alarm information based on the risk level, final response action, target database, application account, and source address in the risk log.

Images