Database access security risk control method, device and product

Abstract

The application provides a database access security risk management method, device and product, and belongs to the technical field of information security. The method comprises the following steps: collecting terminal data and outputting terminal risk score; receiving an SPA single package authentication request sent by the terminal, completing authentication under the condition that the database service port is in a network stealth state, assigning a temporary access port for the current session through a dynamic port mapping algorithm after the authentication is passed, dynamically converging database access permissions according to the terminal risk score, and establishing an encrypted transmission channel; intercepting database access traffic statements, analyzing and extracting SQL behavior characteristics from the database access traffic statements, and blocking high-risk SQL operations in real time; and identifying sensitive data fields in database response traffic statements and performing adaptive desensitization processing. By using the above technical scheme, the cooperative linkage of multiple security modules is realized, and the defects of the existing scheme, such as security protection fragmentation, weak scene adaptation, performance imbalance and poor compatibility of old systems, are avoided.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a risk management method, device and product for database access security. Background Technology

[0002] Current cybersecurity commonly employs a perimeter-based trusted protection model. Once this perimeter is breached, attackers can laterally penetrate and steal core database data. Furthermore, existing database security technologies are highly generalized but lack industry-specific adaptability, failing to accurately identify customized sensitive data such as government administrative divisions, medical records, and financial reports. Most protection solutions also require modification of the database source code or the installation of proprietary plugins, making them difficult to adapt to existing, legacy business systems, resulting in poor compatibility and practicality.

[0003] Existing risk management methods for database access security have the following four main technical shortcomings: 1. Insufficient adaptive capability for sensitive data identification: Traditional solutions rely on static rule matching, which only supports the identification of common sensitive fields and cannot adapt to industry-customized sensitive data; the model adopts a static training method and does not have the ability to iterate and optimize online, resulting in a high rate of false negatives for new business data and high manual maintenance costs.

[0004] 2. Poor accuracy and real-time performance in detecting database risk behaviors: Traditional security devices are deployed independently and rely solely on static blacklists to intercept risk behaviors. They cannot combine terminal security status and user behavior characteristics for multi-dimensional analysis. High-risk SQL operations have high latency and high false alarm rates, which can easily affect normal business operations and maintenance.

[0005] 3. Security protection and system performance cannot be optimized in tandem: Existing security mechanisms only focus on risk interception and are not linked with database resource scheduling strategies. Under high-concurrency access scenarios, the computing power overhead of security detection is too large, resulting in an imbalance in cache resource allocation and causing performance issues such as database access delays and business lag.

[0006] 4. Lack of compatibility between zero-trust architecture and database scenarios: Conventional zero-trust technology only implements network layer access control and does not support database private protocol parsing, SQL behavior recognition and dynamic desensitization. It cannot form fine-grained security control at the database level, and it is difficult to adapt and upgrade old systems. Summary of the Invention

[0007] To address one or more of the aforementioned problems in the prior art, embodiments of the present invention provide a risk management method, device, and product for database access security.

[0008] To achieve the above objectives, on the one hand, a risk management method for database access security is provided, characterized by the following steps: Step S1: Before the terminal initiates a database access request, collect terminal system status, running process data, network access data, and user operation behavior data from the terminal. Detect the terminal security status based on the collected terminal data and output a terminal risk score. In one specific implementation, the above terminal data is collected by a security detection probe deployed on the terminal. Step S2: Receive the SPA single packet authentication request sent by the terminal, complete the authentication while the database service port is in network stealth mode, and after successful authentication, allocate a temporary access port for this session through a dynamic port mapping algorithm, dynamically converge database access permissions according to the terminal risk score, and establish an encrypted transmission channel. Step S3: Intercept database access traffic statements through a database proxy, parse and extract SQL behavior features from the database access traffic statements, and block SQL operations that meet preset high-risk conditions in real time. Step S4: Identify sensitive data fields in the database response traffic statements and perform adaptive desensitization processing based on the preset industry-customized desensitization rule library.

[0009] Preferably, in the risk management method, the step S1 of detecting the terminal security status and outputting a terminal risk score includes: After removing redundant noise data from the collected terminal data using a differential filtering algorithm, normalization preprocessing is performed. The preprocessed data is compared dimension by dimension with the pre-stored terminal security baseline and user behavior baseline, and abnormal features that deviate from the baseline are marked. Calculate the terminal risk score, where: ; in, Assess terminal risk scores. Let be the weight coefficient of the i-th feature dimension. Σ represents the normalized outliers of the data in the i-th feature dimension. = 1, where n is the total dimension of the features.

[0010] Preferably, in the risk control method described above, the SPA single-package authentication request in step S2 is encrypted and encapsulated, the database service port is not visible to the outside world before the authentication is passed, and the server receives and parses the SPA single-package authentication request in stealth mode, performs user identity legality authentication, terminal device compliance authentication, and determines whether the terminal risk score exceeds the terminal risk score threshold. The encrypted transmission channel established after authentication uses the national standard SM4 or AES symmetric encryption algorithm to encrypt subsequent database access traffic.

[0011] Preferably, in the risk management method, step S2, the method of dynamically converging database access permissions based on the terminal risk score includes: The higher the endpoint risk score, the smaller the scope of database operation permissions assigned and the shorter the lifespan of temporary access ports; and, When the terminal risk score exceeds the preset terminal risk score threshold, secondary authentication is triggered or the current database access request is directly rejected.

[0012] Preferably, in the risk management method, in step S3, the database agent is deployed in a serial manner between the business system and the database server. Without modifying the database source code or installing database-specific plugins, it uses multi-protocol adaptive transcoding technology to parse the private communication protocols of multiple mainstream relational databases.

[0013] Preferably, the risk control method for determining whether SQL behavior characteristics meet preset high-risk conditions includes: Based on the characteristics of SQL behavior, a weighted score for SQL behavior risk is determined, where; ; in, Weighted scoring of SQL behavior risk; Risk classification for SQL operation types; Associate risk scores with sensitive fields; Assess terminal risk scores; User behavior compliance score; When the weighted score of SQL behavior risk exceeds the preset SQL behavior risk threshold, the SQL behavior characteristic is determined to meet the preset high-risk condition.

[0014] Preferably, the risk management method further includes one or more of the following: Step S5: Monitor the database operating load status, calculate the comprehensive load factor based on the database cache utilization rate, storage utilization rate and concurrent connection load, and adjust the security detection granularity and / or tighten the protection scope of sensitive data in steps S1 to S3 based on the calculated comprehensive load factor. In step S2, the dynamic port mapping allocation algorithm is implemented using the following formula: ; in, This is a temporary access port. The starting value of the basic port range, As a unique identifier for users, This represents the capacity of the port range.

[0015] Preferably, in the risk management method, step S4 includes: Based on pre-defined sensitive data desensitization rules for various industries, a multi-scenario sensitive word library and recognition benchmark model are constructed. Feature encoding of database traffic statements is performed through an SQL keyword embedding layer; High-concurrency traffic is processed by splitting it into segments using traffic sharding and parallel inference technology. Based on the data sensitivity level, adaptive desensitization is performed at the corresponding desensitization granularity; Specifically, a named entity recognition model equipped with an SQL keyword embedding optimization layer is used to identify sensitive data fields in database response traffic. The SQL keyword embedding optimization layer enhances the features of SQL statements in the following ways:

[0016] in, This is the overall feature vector of the SQL statement. Let j be the vector of the j-th core SQL keyword. Here, m represents the keyword weight, and m represents the total number of core SQL keyword vectors. This also includes: using the blocked SQL operation in step S3 as an abnormal sample for reverse synchronization to the named entity recognition model, and iteratively optimizing the model parameters through a fusion loss function, wherein:

[0017] in, For the fusion loss function, The original recognition loss of the model, The supervisory loss caused by manually annotating outliers, and This is the fusion coefficient.

[0018] On the other hand, an electronic device is also provided, including a memory and a processor, the memory storing at least one program, the at least one program being executed by the processor to implement the steps of the risk management method for database access security as described in any of the above.

[0019] In another aspect, a computer program product is also provided, comprising a computer program, characterized in that, when the computer program is executed by a processor, it implements the steps of the risk management method for database access security as described above. The above technical solution has the following technical effects: The technical solution of this invention realizes a zero-trust access control mechanism that dynamically links terminal risks; by quantifying the terminal security baseline detection results into standardized risk scores, a weighted algorithm is used to realize a dynamic strong correlation between the terminal risk scores and database access permissions, which solves the technical defects of traditional zero-trust systems that only perform static identity authentication and cannot link the real-time security status of the terminal; in a specific implementation, for example, an adaptive access strategy is adopted where the higher the terminal risk, the more convergent the access permissions.

[0020] In a further embodiment, an intelligent closed-loop system of bidirectional iteration between sensitive identification and behavior detection is constructed. This breaks the industry status quo of independent operation of the two types of models. The sensitive identification model is optimized through reverse iteration using abnormal behavior samples, and the model accuracy is continuously optimized based on the quantization loss function. This enables the system to adaptively upgrade without manual intervention, significantly reducing the false negative and false positive rates.

[0021] In a further embodiment, dynamic balance control between security protection and database performance is achieved: through a security policy and operation and maintenance load linkage scheduling mechanism, the database operation status is quantified by the load factor algorithm, and the security detection computing power and desensitization threshold are adaptively adjusted to solve the pain point of mutual constraint between the stricter the protection of traditional security solutions and the worse the business performance.

[0022] In a further embodiment, lightweight and secure adaptation of legacy databases without source code modification is achieved: adopting a SPA stealth gateway + database proxy serial deployment architecture, no database source code modification or plugin deployment is required, relying on dynamic port mapping and multi-protocol adaptive transcoding technology, it is compatible with existing legacy business systems, and the implementation cost is greatly reduced.

[0023] In a further embodiment, an industry-customized, multi-database compatible adaptive security protection system is constructed, which incorporates 72 industry-specific de-identification rules such as government affairs, medical care, finance, and power. It adapts to industry business characteristics through SQL keyword embedding optimization algorithms and relies on adaptive transcoding technology to be compatible with 32 mainstream databases. Its scenario adaptability and generalization ability far exceed those of traditional general security solutions.

[0024] A further embodiment of the present invention solves the technical problems of fragmented protection, weak scenario adaptability, performance imbalance and poor compatibility with old systems in traditional solutions by constructing an integrated closed-loop security management architecture that integrates terminal trusted verification, zero-trust access, intelligent sensitive identification, behavioral risk detection and intelligent operation and maintenance linkage. Attached Figure Description

[0025] Figure 1 This is a flowchart illustrating a risk control method for database access security according to an embodiment of the present invention. Figure 2 This is a schematic diagram of the overall architecture of a risk control method for database access security according to an embodiment of the present invention; Figure 3 A schematic diagram of the processing flow of a risk control method for database access security according to another embodiment of the present invention; Figure 4 This is a schematic diagram of the overall process of a risk control method for database access security according to another embodiment of the present invention. Detailed Implementation

[0026] To further illustrate the various embodiments, the present invention provides accompanying drawings. These drawings are part of the disclosure of the present invention, primarily used to illustrate the embodiments and to explain the operating principles of the embodiments in conjunction with the relevant descriptions in the specification. With reference to these drawings, those skilled in the art should be able to understand other possible implementations and the advantages of the present invention. Components in the drawings are not drawn to scale, and similar component symbols are generally used to represent similar components.

[0027] The present invention will now be further described in conjunction with the accompanying drawings and specific embodiments.

[0028] Example 1: Figure 1 This is a flowchart illustrating a risk control method for database access security according to an embodiment of the present invention. Figure 1 The risk management method for database access security in this embodiment includes the following steps: Step S1: Before the terminal initiates a database access request, terminal system status, running process data, network access data, and user operation behavior data are collected from the terminal. The terminal security status is then detected based on the collected terminal data, and a terminal risk score is output. In one specific implementation, the terminal system status includes one or more of the following: system version, patch updates, and boot time; the running process data includes one or more of the following: process name, process permissions, and malicious process characteristics; the network access data includes one or more of the following: access IP, port, and network link status; and the user operation behavior data includes one or more of the following: access time period, operation frequency, and permission call history. In another specific implementation, terminal data is collected using a security detection probe deployed on the terminal. Step S2: Receive the SPA single packet authentication request sent by the terminal, complete the authentication while the database service port is in a network stealth state, and after successful authentication, allocate a temporary access port for this session through a dynamic port mapping algorithm, dynamically converge the database access permissions according to the terminal risk score, and establish an encrypted transmission channel. Step S3: Intercept database access traffic statements through the database proxy, parse and extract SQL behavior characteristics from the database access traffic statements, and block SQL operations that meet the preset high-risk conditions in real time. Step S4: Identify sensitive data fields in the database response traffic statements and perform adaptive desensitization processing based on the preset industry-customized desensitization rule library.

[0029] Example 2: The risk management method for database access security in this embodiment of the present invention breaks through the technical drawbacks of traditional security modules operating independently and policies being fragmented by setting up a unified policy linkage scheduling engine and constructing a multi-module collaborative closed-loop architecture. Figure 2 This is a schematic diagram of the overall architecture of the risk control method for database access security in this embodiment of the present invention. Figure 3 This is a schematic diagram of the processing flow of the risk control method for database access security in this embodiment of the present invention. Figure 4 This is a schematic diagram of the overall process of the risk control method for database access security in this embodiment of the present invention.

[0030] like Figure 2 The implementation of the method in this embodiment of the invention includes user authentication, dynamic authorization, threat detection, and performance monitoring. Specifically, the system implementing the method of this embodiment includes: a user terminal layer, a zero-trust access layer, a security protection core layer, a scheduling engine hub, and a data service layer.

[0031] In one specific implementation, the overall architecture of the system used to implement the risk control method for database access security in this embodiment includes six functional units: trusted terminal security detection, SPA zero-trust access authentication, iterative sensitive data identification, multi-protocol abnormal behavior detection, intelligent operation and maintenance linkage, and a visual management and control platform. Through a unified policy linkage scheduling engine, data interoperability, policy linkage, and bidirectional iteration are achieved, forming a full-link database security management and control system covering pre-access, in-process protection, and post-optimization.

[0032] The following is combined Figure 3 and Figure 4 The process of the method in the embodiments of the present invention is described.

[0033] Each module executes its corresponding program through the processor to achieve its respective function. The specific technical implementation details are as follows: 1. Trusted Terminal Security Detection Module 1.1 Core Technology Principles A dual assessment system of terminal security baseline and user behavior baseline is constructed. Through lightweight data collection, normalized preprocessing, and risk quantification scoring algorithms, comprehensive and trustworthy verification of access terminals is achieved, and standardized terminal risk scores are output to provide data support for dynamic control of zero-trust permissions.

[0034] 1.2 Step-by-step execution steps Step 1: Lightweight Data Collection. Deploy lightweight data collection probes on the terminal to collect four core categories of data without the terminal being noticed: terminal system status (system version, patch updates, boot time), running process data (process name, process permissions, malicious process characteristics), network access data (access IP, port, network link status), and user operation behavior data (access time period, operation frequency, permission call trajectory).

[0035] Step 2: Data Filtering and Preprocessing. In one specific implementation, a differential filtering algorithm is used to remove redundant data, empty data, and abnormal noise data, while retaining valid feature data, thereby reducing subsequent computing power overhead.

[0036] Step 3: Baseline Comparison and Verification. The preprocessed real-time terminal data is compared dimension by dimension with the locally stored terminal security baseline and user behavior baseline, and abnormal features that deviate from the baseline are marked.

[0037] Step 4: Risk Quantification and Scoring. The terminal's comprehensive risk value, i.e., the terminal risk score, is calculated using a preset multi-dimensional weighted scoring algorithm, and the risk level is classified according to the scoring range in which the terminal risk score falls; the mapping relationship between the scoring range in which the terminal risk score falls and the risk level is preset.

[0038] Step 5: Data Synchronization and Command Response. The terminal risk score and anomaly characteristic data are synchronized to the unified policy linkage scheduling engine in real time. The engine receives control commands and executes alarm, isolation, and permission closure operations.

[0039] 1.3 Core Algorithm and Calculation Formula (1) Data normalization algorithm (Min-Max standardization): eliminates the difference in the units of measurement of data in different dimensions, the formula is as follows:

[0040] in: These are the original feature values ​​of a single dimension. , The minimum and maximum values ​​of the baseline data for this dimension. The normalized standard value for the [0,1] interval.

[0041] (2) The algorithm for terminal risk scoring, i.e., comprehensive terminal risk scoring:

[0042] in: In one specific implementation, the terminal risk score ranges from 0 to 100. Let be the weight coefficient of the i-th feature dimension; where the sum of all weight coefficients is 1; n is the total dimension of the features; in one specific implementation, n=4, including four dimensions: terminal system status, running process, network access, and user operation behavior. In one specific implementation, preferably, the preset weights are: process anomaly 0.4, network anomaly 0.3, operation anomaly 0.2, and system status anomaly 0.1. Let be the normalized outlier of the i-th dimension. In one specific implementation, the normalized outlier is the normalized value that deviates from the terminal security baseline or the user behavior baseline.

[0043] (3) Risk level classification threshold: Risk levels are classified by setting different risk scoring thresholds; in one specific implementation: high risk (0-30 points), medium risk (31-60 points), low risk (61-80 points), and trusted terminal (81-100 points). The above thresholds and classifications can be adjusted as needed and are not considered as restrictions here.

[0044] 1.4 Data Flow Terminal device → Lightweight acquisition probe → Data filtering and preprocessing unit → Baseline comparison unit → Risk scoring calculation unit → Unified strategy linkage scheduling engine → Terminal management and execution unit.

[0045] The arrows indicate the direction of data flow.

[0046] 1.5 Module Interaction Logic This module is the system's front-end risk control unit, continuously outputting terminal trust status data in real time. It strongly integrates with the zero-trust access authentication module: the higher the terminal risk score, the stronger the access permission convergence; high-risk terminals are directly blocked from access, medium- and low-risk terminals adaptively downgrade permissions, and trusted terminals are granted full and compliant permissions. Simultaneously, it receives baseline update instructions from the scheduling engine in real time, supporting dynamic iteration of baseline data. 2. Zero-trust access authentication module based on SPA single-package authorization 2.1 Core Technology Principles Based on the zero-trust "never trust, always verify" mechanism, with SPA single-packet knock authentication as the core, combined with dynamic port mapping, multi-factor verification, and lightweight SM4 national cryptographic encryption technology, a stealthy secure access point is built. Combined with terminal risk scoring, dynamic adaptive control of permissions is achieved, which can be adapted to old systems without modifying the database source code.

[0047] 2.2 Step-by-step execution steps Step 1: Stealth Port Listening. After system initialization, close all explicit database access ports, leaving only the hidden SPA authentication port open to prevent port scanning and unauthorized probes.

[0048] Step 2: SPA Single Packet Knocking Request. When the terminal initiates a database access request, it first sends an encrypted SPA authentication single packet, carrying the terminal device fingerprint, user identity ID, and real-time risk verification code.

[0049] Step 3: Multi-factor access verification. The server parses the SPA data packet and completes triple authentication verification: user identity legitimacy verification, terminal device compliance verification, and terminal risk score threshold verification. The terminal risk score threshold verification includes: determining whether the terminal risk score exceeds the corresponding terminal risk score threshold and determining the risk level.

[0050] Step 4: Dynamic Port Mapping. After successful verification, a dedicated access port is temporarily allocated using a preset dynamic port mapping algorithm to resolve port conflicts caused by multiple services deployed in series. The port validity period can be customized; in one specific implementation, the port validity period is 300 seconds by default.

[0051] Step 5: Lightweight Encrypted Transmission. In one specific implementation, an optimized version of the SM4 national cryptographic algorithm is used to encrypt and encapsulate subsequent database access traffic, establishing a secure transmission channel.

[0052] Step 6: Dynamic Permission Adaptation. Based on real-time terminal risk scores, adaptively adjust the granularity of database access permissions to complete access authorization.

[0053] 2.3 Core Algorithm and Calculation Formula (1) Dynamic port mapping allocation algorithm: ; in: This is a temporary access port. The starting value of the basic port range, As a unique identifier for users, Port range capacity is set to avoid multi-user port conflicts.

[0054] (2) Lightweight SM4 Encryption Optimization Algorithm: Simplifies the traditional SM4 round function, reduces redundant operations by 1 / 4, and achieves encryption latency ≤2ms, making it suitable for high-concurrency scenarios. Core round transformation formula: ; Where ⊕ represents the XOR operation, T(...) represents the composite transformation in the round function, and B... i The new character output in this round will serve as the input for the next round; A i A i+1 A i+2 A i+3 Meaning: SM4 is a 128-bit block, which is split into four 32-bit words. These four indices are the four words that participate in this round of operation.

[0055] (3) Permission-linked convergence algorithm: ; This indicates the authorized permissions; in one specific implementation, a mapping relationship between the terminal risk level and the authorized permissions is pre-set. In one implementation, for high-risk terminals: only query permissions are granted; for medium-risk terminals: core data export and modification permissions are disabled; for low-risk terminals: basic operation and maintenance permissions are granted; for trusted terminals: full compliance business permissions are granted.

[0056] 2.4 Data Flow Terminal access request → SPA encrypted single packet transmission → Zero trust access gateway → Multi-factor verification unit → Dynamic port allocation unit → SM4 encrypted transmission unit → Database server → Access control feedback unit → Unified policy linkage scheduling engine.

[0057] 2.5 Module Interaction Logic This module receives risk score data from the trusted terminal security detection module and adjusts the access control policy accordingly. At the same time, it synchronizes access control logs and unauthorized access records to the visualization platform and audit module to provide evidence for post-event tracing. The access control policy is managed by a unified policy linkage scheduling engine throughout the process, and supports one-click updates of global policies.

[0058] 3. Iterative Sensitive Data Identification Module Based on Human Feedback Reinforcement Learning 3.1 Core Technology Principles In one specific implementation, an iterative NER named entity recognition architecture combining reinforcement learning and human feedback is adopted, along with an SQL keyword embedding layer optimization mechanism and traffic sharding parallel inference technology. Multiple types of industry-customized desensitization rules, such as 72 categories, are pre-built in advance. The model is optimized through reverse iteration using high-risk behavior samples to achieve accurate identification and adaptive desensitization of sensitive data.

[0059] 3.2 Step-by-step execution steps Step 1: Industry Rule Initialization. Load the sensitive data de-identification rules specific to 72 industry categories, including government affairs, healthcare, finance, and power, and build a multi-scenario sensitive word library and recognition benchmark model.

[0060] Step 2: SQL Feature Embedding Optimization. Database traffic statements are feature-encoded using an SQL keyword embedding layer to adapt to database-specific syntax and business characteristics.

[0061] Step 3: Parallel Inference Identification. Using traffic sharding parallel inference technology, high-concurrency traffic is sharded for processing, and multiple threads synchronously complete the initial identification and de-identification of sensitive data.

[0062] Step 4: Manual feedback and correction. Maintenance personnel manually label and correct the identified missed and false alarm samples, generating a correction sample set.

[0063] Step 5: Model Backward Iteration. The model parameters are iteratively optimized by fusing manually labeled samples with high-risk operation samples output by the abnormal behavior detection module using reinforcement learning algorithms.

[0064] Step 6: Adaptive data masking execution. Based on the data sensitivity level, adaptive data masking with the corresponding granularity is executed. In one specific implementation, the corresponding granularity of data masking includes two processing logics: precise data masking, such as field masking, and fuzzy data masking, such as data generalization.

[0065] 3.3 Core Algorithm and Calculation Formula (1) SQL Keyword Embedding Layer Optimization Algorithm: Based on word vector mapping, optimize the feature representation of SQL statements to improve the adaptability to business scenarios. Embedding formula:

[0066] in: This is the overall feature vector of the SQL statement. Let j be the vector of the j-th core SQL keyword. This refers to keyword weighting; in one specific implementation, the weight of core operation words such as SELECT, UPDATE, and DELETE is given priority.

[0067] (2) Model Iteration Loss Optimization Algorithm (to reduce false negative rate): ; in: The original recognition loss of the model, This refers to the supervised loss caused by manually labeled outlier samples. For fusion loss; The weighting coefficients show that the model's false negative rate decreased by a maximum of 14.7% after iteration.

[0068] (3) Traffic fragmentation parallel inference algorithm: The traffic data packets are equally fragmented according to their size, and the inference computing power is dynamically allocated to ensure that the latency in high-concurrency scenarios is ≤5ms.

[0069] 3.4 Data Flow Database access traffic → Traffic sharding unit → SQL feature embedding and encoding → NER sensitivity identification unit → Desensitization processing unit → Business database; Abnormal samples, manually labeled data → Model iteration unit → Identify model parameter updates → Closed-loop optimization.

[0070] 3.5 Module Interaction Logic This module works in two directions with the abnormal behavior detection module: it receives high-risk SQL operation samples from the abnormal behavior detection module for model iteration, and provides sensitive data identification results to the abnormal behavior detection module to assist in risk assessment; it also receives scenario strategies issued by the scheduling engine and dynamically switches industry de-identification rules.

[0071] 4. Database abnormal behavior detection module based on multi-protocol adaptation 4.1 Core Technology Principles By using an adaptive transcoding module compatible with 32 mainstream database protocols, combined with traffic capture, AST syntax tree feature extraction, and machine learning weighted risk scoring mechanism, it achieves real-time identification and millisecond-level blocking of high-risk SQL operations, while also outputting abnormal samples to optimize the sensitive identification model.

[0072] 4.2 Step-by-step execution steps Step 1: Full Traffic Capture. Capture bidirectional database access traffic in real time, filtering out invalid heartbeat packets and redundant data packets.

[0073] Step 2: Multi-protocol adaptive transcoding. Identify the database protocol type and use the adaptive transcoding module to complete private protocol parsing and data format standardization, adapting to domestic and commercial heterogeneous databases.

[0074] Step 3: AST (Abstract Syntax Tree) Feature Extraction. The standardized SQL statements are parsed to construct an abstract syntax tree (AST) and extract core features such as operation type, operation fields, data range, and permission matching degree.

[0075] Step 4: Multidimensional Risk Assessment. In one specific implementation, the risk value of SQL operations is calculated using a preset algorithm, combining static blacklists / whitelists, real-time terminal risks, and user behavior characteristics. In another specific implementation, the preset algorithm is a weighted algorithm. In yet another specific implementation, the preset algorithm is a machine learning algorithm.

[0076] Step 5: Tiered Response. Low-risk behaviors are allowed to proceed and logged; medium-risk behaviors are alerted and warned; high-risk behaviors are blocked in real time.

[0077] Step 6: Sample Reverse Output. High-risk and abnormal SQL operation samples are standardized and pushed to the sensitivity identification module to complete the model iteration loop.

[0078] 4.3 Core Algorithm and Calculation Formula (1) SQL behavior risk weighted scoring algorithm: ; in: Risk classification for SQL operation types Associate risk scores with sensitive fields. Assess terminal risk scores. User behavior compliance score is calculated, with a total weight of 1. A score of ≥80 is considered a high-risk operation. In one implementation, a pre-defined correspondence between SQL operation types and their risk scores is established; for example, deletion or truncation receives a high score, while query operations receive a low score. The specific high and low scores are pre-set based on the scenario. In another implementation, the sensitive field association risk score is determined according to pre-defined sensitive field association risk scoring rules; the user behavior compliance score is determined according to pre-defined user behavior compliance assessment rules. .

[0079] (2) Global similarity verification algorithm (avoiding false positives):

[0080] in, The score represents the global similarity score, ranging from 0 to 100; n represents the total number of feature dimensions. Let be the weight coefficient of the i-th feature, satisfying that the sum of all weight systems is 1; This is the i-th feature value of the current operation and maintenance activity; is the i-th feature value of the historical compliance behavior baseline.

[0081] By comparing historical compliance behavior baselines, the false alarm rate during normal operation and maintenance is reduced. In the test, the overall false alarm rate was as low as 3.5%.

[0082] (3) Blocking response mechanism: The blocking delay for high-risk SQL operations is ≤8ms, achieving seamless real-time protection.

[0083] 4.4 Data Flow Database traffic → Protocol identification and adaptive transcoding unit → AST syntax tree feature extraction → Multidimensional risk scoring unit → Tiered handling unit (allow / alarm / block) → Log evidence storage unit; Abnormal sample data → Sensitive identification model iteration unit.

[0084] 4.5 Module Interaction Logic This module receives global risk control strategies from the unified strategy scheduling engine, synchronizes terminal risk data and sensitive data identification results for joint analysis; outputs abnormal behavior data to optimize the front-end identification model, and outputs risk control logs to the visualization platform and blockchain audit module, forming a detection-iteration-audit closed loop.

[0085] 5. Intelligent operation and maintenance linkage module based on dynamic data factors 5.1 Core Technology Principles Based on prior patented cache scheduling technology, a linkage scheduling mechanism between security policies and operational load is constructed to monitor database operating load parameters in real time, dynamically optimize cache resource configuration, adaptively adjust security detection granularity and de-identification threshold, and balance security protection effectiveness with business operation performance.

[0086] 5.2 Step-by-step execution steps Step 1: Real-time collection of operation and maintenance data. Collect core operating parameters such as database cache utilization, storage utilization, data increment, concurrent access volume, and response latency at the millisecond level.

[0087] Step 2: Load Factor Calculation. The real-time load level of the database is calculated using a dynamic load algorithm to determine high, medium, or low load scenarios.

[0088] Step 3: Dynamically optimize cache resources. Dynamically allocate cache resources based on load levels, expanding core business cache and shrinking non-core cache in high-load scenarios.

[0089] Step 4: Security Policy Adaptation. The load data is synchronized to the scheduling engine. In high-load scenarios, the anonymization threshold is adaptively tightened, non-core security detection processes are simplified, and computational overhead is reduced.

[0090] Step 5: Performance Closed-Loop Control. Real-time monitoring of service access latency and lag rate, and reverse fine-tuning of resource scheduling and security policies to achieve a dynamic balance between performance and security.

[0091] 5.3 Core Algorithm and Calculation Formula (1) Database comprehensive load factor algorithm: ; in: The cache consumes load. For storage load, For concurrent connection load, For the corresponding weights, The system is flagged as high load. 0.8 is the threshold; in other implementations, the threshold can take other appropriate values.

[0092] (2) Safety threshold adaptive adjustment formula: ; in: Based on desensitization or detection threshold, To adjust the coefficients, the detection granularity is adaptively broadened and the protection scope for sensitive data is tightened under high load. In one specific implementation, the security status detection granularity in steps S1 to S3 above is adjusted according to the database load status, as well as the desensitization granularity of sensitive data.

[0093] 5.4 Data Flow Database operating parameters → Operation and maintenance data collection unit → Load factor calculation unit → Cache resource scheduling unit → Database resource layer; Load data → Unified policy scheduling engine → Security module policy adaptive adjustment → Business performance monitoring feedback → Closed-loop optimization.

[0094] 5.5 Module Interaction Logic This module is the core of system performance balancing, and it works in conjunction with all security protection modules to solve the business lag problem caused by traditional security computing power occupation; it pushes system load and resource usage data to the visualization platform in real time to support the visualization of operation and maintenance status.

[0095] 6. Unified strategy-based scheduling engine and visual management platform 6.1 Core Technology Principles The unified strategy linkage scheduling engine is a unique core component of this invention. Through full-domain data synchronization, multi-strategy weighted collaboration, and time-series linkage scheduling algorithms, it enables data interoperability, strategy linkage, and bidirectional iteration among the six functional units. The supporting visualization platform integrates asset management, strategy configuration, situation display, and blockchain evidence storage and auditing capabilities to meet compliance requirements.

[0096] 6.2 Step-by-step execution steps Step 1: Global Policy Initialization. After system startup, the global security policy, operation and maintenance scheduling policy, and industry-specific de-identification policy are loaded, completing the synchronous initialization of policies for each module.

[0097] Step 2: Multi-source data aggregation. Real-time aggregation of terminal risk data, access logs, sensitive identification data, abnormal behavior data, database load data, and operation and maintenance data.

[0098] Step 3: Strategy Coordination and Analysis. Based on multi-source data, dynamically adjust the operating strategies of each module to achieve adaptive regulation that prioritizes higher risks, stricter protection, higher loads, and optimal computing power.

[0099] Step 4: Instruction Issuance and Execution. Dynamic control instructions are issued to each functional module, and protection rules, resource scheduling rules, and permission policies are updated synchronously.

[0100] Step 5: Visualization and Evidence Preservation. Summarize all data from the entire process to generate a visual interface for security posture, asset status, and operation logs; use the blockchain evidence preservation module to upload and solidify all operation logs and security records onto the blockchain.

[0101] 6.3 Core Algorithm and Calculation Formula (1) Multi-module strategy collaborative weighted algorithm: ; in: This is the globally optimal strategy. For local strategies of each submodule, The weighting is adjusted based on the module weights: the weight of security modules is increased in high-risk scenarios, and the weight of operations and maintenance modules is increased in high-load scenarios.

[0102] (2) Blockchain Evidence Storage Hash Solidification Algorithm: The SHA-256 hash algorithm is used to encrypt and solidify the log data, generating a unique evidence storage identifier to ensure that the data cannot be tampered with.

[0103] 6.4 Data Flow Operational data of each functional module → Global data aggregation unit → Strategy linkage and analysis unit → Command issuance unit → Each functional module; Full-process log → Blockchain evidence storage unit → Visualized situation display unit → Compliance audit output.

[0104] 6.5 Module Interaction Logic This module is the central core of the system, coordinating the operation of all sub-modules and breaking down data silos and policy fragmentation between modules; the visualization platform provides operation and maintenance personnel with operation entry points, status displays, and audit traceability capabilities, supporting manual intervention and custom policy configuration.

[0105] 7. Overall System Collaborative Closed-Loop Workflow Step 1: System initialization. The unified policy linkage scheduling engine issues global security protection policies, operation and maintenance resource scheduling policies, and industry de-identification rules, and completes the initialization of all module parameters.

[0106] Step 2: Before the terminal connects, the trusted terminal security detection module collects terminal data in real time, completes risk scoring, and synchronizes it to the scheduling engine.

[0107] Step 3: The terminal initiates a database access request. The SPA zero-trust access module performs single-packet knock-on authentication and multi-factor verification, dynamically allocates permissions and temporary access ports based on the terminal's risk score, and establishes an encrypted transmission channel.

[0108] Step 4: After the access traffic enters the system, the iterative sensitive data identification module completes SQL feature optimization, accurate identification of sensitive data, and adaptive desensitization.

[0109] Step 5: The multi-protocol abnormal behavior detection module parses database traffic, extracts SQL behavior features, assesses risks from multiple dimensions, blocks high-risk operations in real time, and synchronizes abnormal samples to the sensitive identification module to complete model iteration.

[0110] Step 6: The intelligent operation and maintenance linkage module monitors the database load in real time, dynamically optimizes cache resources, and coordinates with the security module to adjust the protection granularity, balancing security and business performance.

[0111] Step 7: All access, protection, operation and maintenance, and abnormal operation logs are aggregated to the scheduling engine in real time, and solidified through blockchain. The visualization platform renders the security situation and operation and maintenance data in real time, forming a complete closed loop of pre-access, in-process protection, post-iteration iteration, and full traceability.

[0112] Example 3: In embodiments of the present invention, one or more of the following extensions may also be included: 1. Model Architecture Expansion: Based on the self-developed SQL keyword embedding layer optimization framework, it can be adapted to various basic models such as attention mechanism and lightweight convolutional neural network, further improving the sensitivity recognition accuracy in complex business scenarios; 2. Detection algorithm expansion: The abnormal behavior detection can be adapted to lightweight machine learning algorithms such as isolated forest and autoencoder, and can meet the computing power deployment requirements of databases of different sizes; 3. Encryption scheme expansion: Based on the existing lightweight SM4 encryption architecture, it can be expanded to include SM2 and SM3 national cryptographic algorithms, improve the whole process of domestic encryption system, and adapt to higher-level information technology innovation compliance scenarios; 4. Deployment mode expansion: The system supports two modes: centralized single-machine deployment and distributed multi-node cloud deployment, which can adapt to the small-scale deployment needs of small and medium-sized units and the distributed deployment needs of large groups across the entire domain. 5. Compliance capability expansion: Based on the existing government blockchain evidence storage module, it can be connected to local government trusted evidence storage platforms to achieve compliant on-chain traceability of security logs and operation records, meeting the compliance audit requirements of Level 3 or above of the Information Security Protection System.

[0113] Example 4: The present invention also provides an electronic device, which includes a processor, a memory, a bus, and a computer program stored in the memory and executable on the processor. The processor includes one or more processing cores, and the memory is connected to the processor via the bus. The memory is used to store program instructions, and when the processor executes the computer program, it implements the steps in the above-described method embodiment of Embodiment 1 of the present invention.

[0114] Furthermore, as an executable solution, the electronic device can be a computer unit, which can be a desktop computer, laptop, handheld computer, cloud server, or other computing device. The computer unit may include, but is not limited to, a processor and memory. Those skilled in the art will understand that the above-described structure of the computer unit is merely an example and does not constitute a limitation on the computer unit. It may include more or fewer components, or combine certain components, or use different components. For example, the computer unit may also include input / output devices, network access devices, buses, etc., and this embodiment of the invention does not limit this.

[0115] Furthermore, as an executable solution, the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor, etc. The processor is the control center of the computer unit, connecting various parts of the entire computer unit via various interfaces and lines.

[0116] The memory can be used to store the computer programs and / or modules. The processor implements various functions of the computer unit by running or executing the computer programs and / or modules stored in the memory and by calling data stored in the memory. The memory may mainly include a program storage area and a data storage area. The program storage area may store the operating system and at least one application program required for a function; the data storage area may store data created based on the use of the mobile phone, etc. In addition, the memory may include high-speed random access memory and may also include non-volatile memory, such as hard disk, RAM, plug-in hard disk, smart media card (SMC), secure digital card (SD card), flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0117] Example 5: The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the steps described above.

[0118] Although the invention has been specifically shown and described in conjunction with preferred embodiments, those skilled in the art should understand that various changes in form and detail may be made to the invention without departing from the spirit and scope of the invention as defined in the appended claims, all of which shall be within the scope of protection of the invention.

Claims

1. A risk management method for database access security, characterized in that, Includes the following steps: Step S1: Before the terminal initiates a database access request, collect terminal system status, running process data, network access data and user operation behavior data from the terminal, detect the terminal security status based on the collected terminal data, and output the terminal risk score. Step S2: Receive the SPA single packet authentication request sent by the terminal, complete the authentication while the database service port is in network stealth mode, and after successful authentication, allocate a temporary access port for this session through a dynamic port mapping algorithm, dynamically converge database access permissions according to the terminal risk score, and establish an encrypted transmission channel. Step S3: Intercept database access traffic statements through a database proxy, parse and extract SQL behavior features from the database access traffic statements, and block SQL operations that meet preset high-risk conditions in real time. Step S4: Identify sensitive data fields in the database response traffic statements and perform adaptive desensitization processing based on the preset industry-customized desensitization rule library.

2. The risk management method according to claim 1, characterized in that, The step S1, which involves detecting the terminal's security status and outputting a terminal risk score, includes: After removing redundant noise data from the collected terminal data using a differential filtering algorithm, normalization preprocessing is performed. The preprocessed data is compared dimension by dimension with the pre-stored terminal security baseline and user behavior baseline, and abnormal features that deviate from the baseline are marked. Calculate the terminal risk score, where: ； in, Assess terminal risk scores. Let be the weight coefficient of the i-th feature dimension. Σ represents the normalized outliers of the data in the i-th feature dimension. = 1, where n is the total dimension of the features.

3. The risk management method according to claim 1, characterized in that, In step S2, the SPA single-packet authentication request is encrypted and encapsulated. The database service port is not visible to the outside world before the authentication is successful. After receiving and parsing the SPA single-packet authentication request in stealth mode, the server performs user identity legality authentication, terminal device compliance authentication, and determines whether the terminal risk score exceeds the terminal risk score threshold. The encrypted transmission channel established after authentication uses the national standard SM4 or AES symmetric encryption algorithm to encrypt subsequent database access traffic.

4. The risk management method according to claim 1, characterized in that, The methods for dynamically converging database access permissions based on terminal risk scores in step S2 include: The higher the endpoint risk score, the smaller the scope of database operation permissions assigned and the shorter the lifespan of temporary access ports; and, When the terminal risk score exceeds the preset terminal risk score threshold, secondary authentication is triggered or the current database access request is directly rejected.

5. The risk management method according to claim 1, characterized in that, In step S3, the database agent is deployed in a serial manner between the business system and the database server. Without modifying the database source code or installing database-specific plugins, it uses multi-protocol adaptive transcoding technology to parse the private communication protocols of multiple mainstream relational databases.

6. The risk management method according to claim 1, characterized in that, Determining whether SQL behavior characteristics meet preset high-risk conditions includes: Based on the characteristics of SQL behavior, a weighted score for SQL behavior risk is determined, where; ； in, Weighted scoring of SQL behavior risk; Risk classification for SQL operation types; Associate risk scores with sensitive fields; Assess terminal risk scores; User behavior compliance score; When the weighted score of SQL behavior risk exceeds the preset SQL behavior risk threshold, the SQL behavior characteristic is determined to meet the preset high-risk condition.

7. The risk management method according to claim 1, characterized in that, It also includes one or more of the following: Step S5: Monitor the database operating load status, calculate the comprehensive load factor based on the database cache utilization rate, storage utilization rate and concurrent connection load, and adjust the security detection granularity and / or tighten the protection scope of sensitive data in steps S1 to S3 based on the calculated comprehensive load factor. In step S2, the dynamic port mapping allocation algorithm is implemented using the following formula: ； in, This is a temporary access port. The starting value of the basic port range, As a unique identifier for users, This represents the capacity of the port range.

8. The risk management method according to claim 1, characterized in that, Step S4 includes: Based on pre-defined sensitive data desensitization rules for various industries, a multi-scenario sensitive word library and recognition benchmark model are constructed. Feature encoding of database traffic statements is performed through an SQL keyword embedding layer; High-concurrency traffic is processed by splitting it into segments using traffic sharding and parallel inference technology. Based on the data sensitivity level, adaptive desensitization is performed at the corresponding desensitization granularity; Specifically, a named entity recognition model equipped with an SQL keyword embedding optimization layer is used to identify sensitive data fields in database response traffic. The SQL keyword embedding optimization layer enhances the features of SQL statements in the following ways: in, This is the overall feature vector of the SQL statement. Let j be the vector of the j-th core SQL keyword. Here, m represents the keyword weight, and m represents the total number of core SQL keyword vectors. This also includes: using the blocked SQL operation in step S3 as an abnormal sample for reverse synchronization to the named entity recognition model, and iteratively optimizing the model parameters through a fusion loss function, wherein: in, For the fusion loss function, The original recognition loss of the model, The supervisory loss caused by manually annotating outliers, and This is the fusion coefficient.

9. An electronic device, characterized in that, The system includes a memory and a processor, the memory storing at least one program that is executed by the processor to implement the steps of the risk management method for database access security as described in any one of claims 1 to 8.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the risk management method for database access security as described in any one of claims 1 to 8.

Images