Artificial intelligence identification method and system for internal abnormal identity behavior and data leakage risk

Abstract

The application provides an AI identification method and system for internal abnormal identity behavior and data leakage risk, relating to the technical field of behavior identification, wherein the method comprises: obtaining operation and maintenance access records, database query records, operation and maintenance work orders and sensitive table structure data, determining actual operators according to the data and forming cross-sub-session query fragment sets, updating task progress states and table splicing progress states according to work order task nodes, sensitive fields and record range completion conditions, determining deviating query fragments with task progress states not advancing and table splicing progress states changing from unclosed to closed, replaying the cross-sub-session query fragment sets and the stripped query fragment sequences in a verification environment according to fixed conditions, and generating abnormal identity behavior identification results and data leakage risk identification results when the task results are the same and the table splicing results change from closed to unclosed, which is used to form reviewable internal data access risk evidence chains.

Description

Technical Field

[0001] This application relates to the field of behavior recognition technology, and in particular to an AI method and system for identifying internal abnormal identity behavior and data leakage risks. Background Technology

[0002] Enterprise internal database operations and maintenance have gradually shifted from direct connections to fixed terminals to unified operations and maintenance entry points, database proxies, and temporary authorized connections. Common security controls include unified identity authentication, bastion host auditing, database auditing, operations and maintenance work order management, and data leakage prevention. Unified identity authentication and bastion hosts store login information, terminals, accounts, access objects, and connection periods. Database auditing parses query statements and records accessed tables, accessed fields, the number of returned records, and execution results. Operations and maintenance work orders store fault objects, authorized scopes, and handling processes. Data leakage prevention generates alarms based on field hierarchical marking or export rules.

[0003] Solutions similar to those for identifying internal abnormal behavior and data leakage risks typically combine database auditing with user entity behavior analysis. They use login accounts or single database connections as the analysis subject, extracting behavioral characteristics from access time, terminal, query statement type, access object, number of returned records, and data sensitivity level. Within a fixed time window, they statistically analyze query frequency, number of fields, and return scale, and compare them with the historical baseline or alarm threshold of the corresponding account. Some solutions further filter normal operations based on authorized personnel, authorized time periods, and target systems in the maintenance work order, ultimately generating alarms for abnormal access or data leakage.

[0004] In internal operations and maintenance scenarios where database proxies, jump connections, and temporary accounts coexist, the same operation process may be dispersed into multiple short-duration connections. Fault verification queries and batch data readings occur intermittently. The query frequency, return scale, and baseline deviation formed by each connection are still within the normal fluctuation range. As a result, existing solutions tend to break continuous operations into multiple low-intensity events and keep the alarm objects at the account or single connection level, resulting in identification biases in the attribution of the same internal operations and maintenance process and the corresponding data access purpose. Summary of the Invention

[0005] This application provides an AI-based method and system for identifying internal abnormal identity behavior and data leakage risks. The technical problem to be solved is that the identification results of abnormal identity behavior and data leakage risks are biased because the same internal operation and maintenance process is recorded in multiple database sub-sessions.

[0006] To address the aforementioned technical problems, in a first aspect, this application provides an AI-based method for identifying internal abnormal identity behavior and data leakage risks, comprising: Obtain operation and maintenance access records, database query records, operation and maintenance work orders, and sensitive table structure data; correlate operation and maintenance access records and database query records to determine the actual operator. Based on database query records, a set of cross-sub-session query fragments of the actual operator is formed, and the target sensitive table is determined based on the sensitive table structure data. Update the task progress status of the actual operator based on the completion status of the task nodes in the maintenance work order. Update the table-building progress status of the target sensitive table based on the completion status of sensitive fields and record ranges in the target sensitive table according to the cross-sub-session query fragment set; A divergent query fragment that determines the progress status of an unadvanced task from the cross-sub-session query fragment set and changes the table concatenation progress status from an open state to a closed state. A closed state indicates that the query results cover sensitive fields and record ranges. In the verification environment, the set of cross-sub-session query fragments is replayed to obtain the first task result of the actual operator and the first table concatenation result of the target sensitive table. After stripping away the divergent query fragments, the remaining query fragments are replayed to obtain the second task result of the actual operator and the second table concatenation result of the target sensitive table. If the results of the first task and the second task are the same, the first table concatenation result is in a closed state and the second table concatenation result is in an open state, generate the abnormal identity behavior identification result of the actual operator and the data leakage risk identification result of the target sensitive table.

[0007] Optionally, correlate operation and maintenance access records and database query records to determine the actual operator, including: The real-name anchor sub-session is determined based on the real-name login identifier in the operation and maintenance access record; Candidate database sub-sessions are selected from the operation and maintenance access records based on the access terminal identifier and access time period of the real-name anchored sub-session; Extract the query input data and query result data of each candidate database sub-session from the database query records to form session input and output data; From the session input and output data, the data that exists only in the query result data of the previous candidate database sub-session and is used as query input data by the next candidate database sub-session is identified as the successor data; Establish a targeted connection relationship between the previous candidate database sub-session and the next candidate database sub-session based on the received data; Connect to the real-name anchored sub-session along the directional connection relationship to form an operator session chain, and determine the person corresponding to the operator session chain based on the real-name login identifier corresponding to the operator session chain, and identify the person corresponding to the operator session chain as the actual operator.

[0008] Optionally, a set of cross-sub-session query fragments for the actual operator is formed based on database query records, including: Arrange the candidate database sub-sessions according to the directional connection relationship in the operator session chain to obtain the sub-session sequence; Extract the table identifier, field identifier, associated anchor field, record range, and continuation data sequentially from the database query records corresponding to the sub-session sequence to form the original query fragment; Establish the query segment connection relationship based on the input and output data of each original query segment; Set a break flag between adjacent original query segments that do not have a query segment connection relationship; If a subsequent original query segment uses the data inherited from the previous original query segment, or if the starting anchor value of the record range of a subsequent original query segment is immediately adjacent to the ending anchor value of the record range of the previous original query segment in the sorting order of the associated anchor field, the corresponding break marker will be replaced with the query segment connection relationship. A cross-subsession query fragment set is formed based on each original query fragment, the query fragment connection relationship, and the remaining disconnect markers.

[0009] Optionally, the table-building progress status of the target sensitive table is updated based on the completion status of sensitive fields and record ranges in the target sensitive table according to the cross-sub-session query fragment set, including: Set the associated anchor field of the target sensitive table as the anchor node, set the sensitive field of the target sensitive table as the field node, and set the record range node according to the record range boundary of the cross-sub-session query fragment set to form a set of nodes to be completed; If the sensitive fields and record ranges obtained from the original query fragment correspond to the same associated anchor value, establish connection edges between the anchor node, the corresponding field node, and the corresponding record range node to form a table concatenation relationship graph; Extract anchor nodes, field nodes and record range nodes that are in the same connected part as the anchor nodes from the table relationship graph to form an effective set of completion nodes; The remaining set of nodes to be filled is formed by the difference between the set of nodes to be filled and the set of nodes that have been filled. If the set of remaining nodes to be completed is empty, update the table completion status to closed; if the set of remaining nodes to be completed is not empty, update the table completion status to unclosed.

[0010] Optionally, the divergent query segments that determine the progress status of unadvanced tasks from the cross-sub-session query segment set and change the table concatenation progress status from an open state to a closed state include: The final closed concatenation graph is determined when the cross-sub-session query fragment set is completed. Extract all connection paths from the anchor node to each field node and record range node from the final closed concatenation relationship graph to form a set of connection paths; Map the connection edges in the connection path set to the corresponding original query fragments to form a candidate query fragment set; Compare the task progress status before and after the execution of each candidate query segment, and retain the candidate query segments with the same task progress status before and after execution from the candidate query segment set to form a set of query segments that do not contribute to the task. The closed and broken segment groups are determined based on the results of virtual stripping of query segments in the set of query segments that do not contribute to the task. When all closed and broken segment groups are retained, the final closed table relationship graph is in a closed state. When all closed and broken segment groups are stripped, the final closed table relationship graph is in an unclosed state. When any proper subset of the closed and broken segment groups is stripped, the final closed table relationship graph is still in a closed state. The query segments in the closed and broken segment group are identified as divergent query segments.

[0011] Optionally, the target sensitive table is determined based on the sensitive table structure data, including: Extract the key relationships and sensitive field markers of each data table from the sensitive table structure data to form data table relationship data; Based on the data table associations, the main table containing customer identity information, which uses the customer ID field as the primary or unique key and is associated with the name, ID number, mobile phone number, bank account number, and address fields, is identified as the target sensitive table.

[0012] Optionally, the task progress status of the actual operator can be updated based on the completion status of the task nodes in the maintenance work order, including: A sequence of task nodes is formed based on the task operations in the maintenance work order and the execution dependencies between the task operations. Identify the first incomplete task node from the task node sequence; If the query results in the cross-sub-session query fragment set and the execution record of the operation and maintenance work order together provide the input data and completion evidence required for the first incomplete task node, mark the first incomplete task node as completed, and update the task progress status according to the completion mark.

[0013] Optionally, the set of query fragments across sub-sessions is replayed in the verification environment to obtain the first task result of the actual operator and the first concatenation result of the target sensitive table, including: Create a copy of the target sensitive table structure in the verification environment and write it to non-production verification data to form a verification data snapshot; Fixed function return values ​​and transaction execution order form replay conditions; Based on the replay conditions, the cross-sub-session query fragment set is replayed using the verification data snapshot to obtain the complete replay result; Based on the complete playback results, determine the first task result of the actual operator and the first composite result of the target sensitivity table.

[0014] Optionally, after stripping the divergent query fragments, the remaining query fragments are replayed to obtain the second task result for the actual operator and the second concatenation result for the target sensitive table, including: Set a no-operation flag at the original execution position of the query segment that deviates from the query segment to form a sequence of stripped query segments; Based on the playback conditions, the query segment sequence after stripping and replaying the verification data snapshot is used to obtain the second task result and the second table concatenation result.

[0015] Secondly, this application provides an AI-based system for identifying internal abnormal identity behavior and data leakage risks, including: The data attribution construction module is used to obtain operation and maintenance access records, database query records, operation and maintenance work orders and sensitive table structure data, and associate operation and maintenance access records and database query records to determine the actual operator; The data attribution construction module is also used to form a cross-sub-session query fragment set of the actual operator based on the database query records, determine the target sensitive table based on the sensitive table structure data, and provide the actual operator, cross-sub-session query fragment set, operation and maintenance work order and target sensitive table to the dual progress analysis module; The dual-progress analysis module is used to update the task progress status of the actual operator according to the task node completion status of the operation and maintenance work order and the execution order of the query segments in the cross-sub-session query segment set. The dual-progress analysis module is also used to update the table-building progress status of the target sensitive table according to the execution order of the query segments based on the completion status of sensitive fields and record ranges of the cross-sub-session query fragment set, and provide the task progress status and table-building progress status to the deviation positioning module. The divergence positioning module is used to determine the progress status of unprogressed tasks from the cross-sub-session query fragment set and to change the table concatenation progress status from an unclosed state to a closed state. The closed state indicates that the query results cover sensitive fields and record ranges. The deviation location module is also used to provide deviation query fragments and cross-sub-session query fragment sets to the replay verification and risk output module; The replay verification and risk output module is used to replay the set of query fragments across sub-sessions in the verification environment, and replay the remaining query fragments after stripping away the divergent query fragments, to obtain the first and second task results of the actual operator, as well as the first and second splicing results of the target sensitive table. The replay verification and risk output module is also used to generate abnormal identity behavior identification results of the actual operator and data leakage risk identification results of the target sensitive table when the results of the first task and the second task are the same, the first table concatenation result is in a closed state and the second table concatenation result is in an unclosed state.

[0016] The technical solution provided in this application has the following beneficial effects: This application identifies the actual operator by establishing a data connection between operation and maintenance access records and database query records, and organizes query records in different database sub-sessions into the same cross-sub-session query fragment set, thereby maintaining the continuity between the operation subject, query order, and data source, and reducing the impact of database account changes or connection splits on the attribution of the operation process.

[0017] Based on the continuous operation process, this application maintains the task progress status and the table assembly progress status respectively. The task progress status records the progress of the maintenance work order, and the table assembly progress status records the coverage of the sensitive fields on the target anchor value set. When the query segment keeps the task progress status unchanged and turns the table assembly progress status into a closed state, the sensitive data integrity function can be located to the corresponding deviating query segment.

[0018] After the location is established, the full replay and the stripped replay use the same verification data snapshot, function return value and transaction order, so that the difference between the two replays is focused on the divergent query fragment and the corresponding dependent stripped fragment. The results of the first task are the same as those of the second task, which confirms that the stripping operation has not changed the result of the work order task. The first concatenation result is closed and the second concatenation result is not closed, which further confirms that the divergent query fragment has a definite effect on the complete coverage of sensitive fields.

[0019] The above processing sequentially completes the attribution of the actual operator, comparison of the two types of progress status, location of the divergent query segment, and confirmation of data layer replay, so that the abnormal identity behavior identification results correspond to the specific session chain, query segment, and table status changes, thereby improving the verifiability and evidence relevance of the identification results. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a schematic diagram of the AI ​​identification method for internal abnormal identity behavior and data leakage risk in the embodiments of this application.

[0022] Figure 2This is a schematic diagram illustrating the formation process of the operator session chain in an embodiment of this application.

[0023] Figure 3 This is a schematic diagram illustrating the formation process of the cross-sub-session query fragment set in an embodiment of this application.

[0024] Figure 4 This is a schematic diagram illustrating the table arrangement relationship diagram and the update process of the table arrangement progress status in the embodiments of this application.

[0025] Figure 5 This is a schematic diagram illustrating the process of determining the deviated query segment in an embodiment of this application.

[0026] Figure 6 This is a schematic diagram illustrating the verification process of complete playback and stripping playback in the embodiments of this application. Detailed Implementation

[0027] The following description, in conjunction with the accompanying drawings, illustrates the specific implementation process of this embodiment using an enterprise database operation and maintenance audit scenario.

[0028] In an exemplary enterprise database operation and maintenance scenario, operations and maintenance personnel handle data import failures, status verifications, or data repair work orders via a bastion host or unified operations and maintenance portal. Multiple database sub-sessions can be established sequentially during the same real-name login process, and each sub-session can use a different database account. An identification server deployed in the enterprise intranet security domain continuously analyzes these distributed operations, verifying that the verification environment is isolated from the production database, and that queries in the production database are not re-executed during the verification process.

[0029] To determine the attribution of distributed operations, a unified operations and maintenance (O&M) portal provides O&M access records to the identification server, while the database auditing system provides database query records to the identification server. O&M access records include real-name login identifier, access terminal identifier, access time period, access target identifier, and sub-session identifier; database query records include sub-session identifier, query time, query statement, bound parameters and source identifier, result column identifier, result unit source identifier, associated anchor value, transaction identifier, and execution status.

[0030] After obtaining the operation records, the identification server also reads the operation and maintenance work orders from the operation and maintenance work order system and the sensitive table structure data from the sensitive data directory. The operation and maintenance work order includes the work order identifier, target system, task operation, execution dependencies, required inputs, and completion flags; the sensitive table structure data includes the table identifier, field identifier, primary key, unique key, foreign key, key relationships, and sensitive field flags. The sensitive field flags can directly adopt the flags from the existing sensitive data directory or data classification system.

[0031] After the above data enters the identification server, the time records of each data source are first converted to the same time base. The identification server then associates the operation and maintenance access records with the database query records based on the sub-session identifier, access target identifier, and query time. Records lacking an association identifier are retained as unassociated records and do not participate in the formation of the current operator's session chain.

[0032] The identification server repeatedly executes the method of this embodiment according to the audit task cycle. The actual analysis cycle is set according to the log archiving cycle of the database audit system. For example, after each log archiving cycle is completed, the identification server reads the newly added records and continues the operator session chain, task progress status, and table splicing progress status that have not yet ended. The analysis cycle is used to trigger incremental reading, and cross-cycle query segments are still connected according to the received data and work order identifier.

[0033] After data association is completed, the recognition server uses a rule-based symbolic reasoning engine to perform AI recognition. The symbolic reasoning engine uses equality, inclusion, graph connectivity, and whether the set is empty as deterministic conditions, and passes the output of the previous rule to the next rule; data acceptance events, task node completion events, table closure events, and replay result changes constitute the basis for state division in sequence.

[0034] In this process, a sub-session represents a database connection unit established by operations and maintenance personnel through the operations and maintenance portal. The cross-sub-session query fragment set organizes the original query fragments according to the data inheritance relationship and the record range connection relationship. The task progress status and table assembly progress status are updated separately according to the order of the same query fragment, so as to compare the different effects of the same original query fragment on the operations and maintenance task and the coverage of sensitive data.

[0035] Having clarified the above scenarios, data sources, and processing order, the following steps are... Figure 1 The flowchart illustrates steps S101 to S108; wherein, the actual operator is the person who belongs to the operator's session chain based on the real-name anchored sub-session and the directional acceptance relationship, and is used to identify the person to whom the operator's session chain belongs corresponding to the identification result.

[0036] Step S101: Obtain operation and maintenance access records, database query records, operation and maintenance work orders and sensitive table structure data, and associate operation and maintenance access records and database query records to determine the actual operator.

[0037] Specifically, the identification server reads the real-name login identifier from the operation and maintenance access records, determines the database connection sub-session of the corresponding database audit record as the real-name anchoring sub-session, and uses the real-name anchoring sub-session as the head sub-session of the operator session chain, and selects the personnel corresponding to the real-name login identifier as candidates for actual operators.

[0038] Subsequently, candidate database sub-sessions are selected from sub-sessions that use the same access terminal, have overlapping access periods, and have the same access target database instance. Real-name anchored sub-sessions are included in the candidate database sub-session set.

[0039] Extract query input data and query result data from the database query records of each candidate database sub-session. Query input data includes binding parameters, temporary table inputs, and cursor inputs. Query result data includes result columns, result cell sources, associated anchor values, and result range boundaries.

[0040] The audit collection program is deployed on the query result return link and query request sending link of the unified operation and maintenance portal or database agent. When the query result is returned, the audit collection program generates a source identifier for the result unit and establishes a source mapping record including the source identifier, sub-session identifier, query record identifier, result column identifier, result row sequence number, and result value summary. When subsequent queries use the corresponding result value as a binding parameter, temporary table input, or cursor input, the audit collection program calculates the input value summary and matches it with the source mapping record, writing the uniquely matching source identifier into the database query record; if multiple matching sources exist or no matching source exists, the corresponding input is marked as source uncertain.

[0041] The identification server identifies the query results that uniquely point to the previous candidate database sub-session and are used as query input by the next candidate database sub-session as the receiving data. Data value consistency can be verified using SHA-256 digest. If there is a source conflict, a missing source, or inconsistent data value verification, no directional receiving relationship is established.

[0042] The identification server establishes a directional connection relationship between the previous candidate database sub-session that generates the receiving data and the subsequent candidate database sub-session that uses the receiving data, with the data generation order pointing to the data usage order.

[0043] The identification server sets the real-name anchored sub-session as the head sub-session of the chain and checks the remaining candidate database sub-sessions in reverse along the directional inheritance relationship, forming an operator session chain. For example... Figure 2 As shown, each non-chain-first candidate database sub-session in the operator session chain can trace back to the real-name anchored sub-session along the directional connection relationship. The identification server determines the person corresponding to the operator session chain based on the real-name login identifier corresponding to the real-name anchored sub-session, and identifies the person corresponding to the operator session chain as the actual operator. The actual operator and the operator session chain obtained in this way will be used to form a cross-sub-session query fragment set. After determining the actual operator, the process proceeds to step S102.

[0044] Step S102: Based on the database query records, form a set of cross-sub-session query fragments for the actual operator, and determine the target sensitive table based on the sensitive table structure data.

[0045] Specifically, the identification server arranges candidate database sub-sessions according to the directional acceptance relationship to form a sub-session sequence; when there are multiple sub-sessions that can be arranged simultaneously, the order is determined according to the query time of the first query record and the database audit record number.

[0046] The identification server uses a structured query parser to parse the query statement. For example, it uses the existing Apache Calcite SQL Parser to extract the source table, result fields, join conditions, and filter conditions. It also combines sensitive table structure data to eliminate aliases and extracts table identifiers, field identifiers, related anchor fields, record ranges, and continuation data from the database query records to form the original query fragment.

[0047] The anchor field is a primary key or unique key field used to establish correspondences between records in different query results. When the original query fragment accesses the target sensitive table, the primary key of the target sensitive table is used first as the anchor field. When the query statement is associated with the target sensitive table through a unique key or foreign key, the corresponding fields are converted into anchor fields of the target sensitive table using the key relationships in the sensitive table's structure data. The record range can be represented as a set of anchor values, a continuous interval, or several intervals defined by the query conditions. The original query fragment also records the database sub-session identifier, execution order, transaction identifier, execution status, input data, and output data for subsequent connection establishment and execution replay.

[0048] The identification server establishes query segment connections based on the input and output data of each original query segment. When the output data of a previous original query segment matches the input data of a subsequent original query segment, the identification server establishes a directed query segment connection between the two original query segments. If no query segment connection is established between adjacent original query segments, the identification server sets a disconnect marker between the two original query segments. This disconnect marker indicates that the existing input and output evidence is insufficient to demonstrate that the two original query segments represent a continuous data acquisition process.

[0049] For adjacent original query segments marked with a break tag, the identification server further examines data usage relationships and record range adjacency relationships. When the subsequent original query segment uses the continuation data output by the preceding original query segment, the identification server replaces the corresponding break tag with the query segment connection relationship. Even if the subsequent original query segment does not directly use the output continuation data, but the starting anchor value of the record range of the subsequent original query segment is immediately adjacent to the ending anchor value of the record range of the preceding original query segment in the sorting order of the associated anchor field, the identification server also replaces the corresponding break tag with the query segment connection relationship.

[0050] The disconnect flag is replaced by the query fragment connection relationship only when two adjacent original query fragments access the same target sensitive table, use the same associated anchor field, and the end anchor value of the previous record range and the start anchor value of the next record range are adjacent in the corresponding sorting rules; the disconnect flag is retained when the record range cannot be resolved or the query execution fails.

[0051] The identification server forms a cross-sub-session query fragment set based on each original query fragment, the query fragment connection relationship, and the remaining disconnect markers. For example... Figure 3 As shown, the cross-subsession query fragment set retains the original execution order and disconnection position, and identifies the server to update the table concatenation progress status in units of connected parts formed by the connection relationship of query fragments, so as not to merge independent query fragments lacking continuation evidence into the same connected part.

[0052] After the cross-sub-session query fragment set is formed, the identification server extracts the primary key, unique key, foreign key and sensitive field markers from the sensitive table structure data to form data table association data, and completes field mapping according to the semantic tags in the sensitive data directory.

[0053] For example, a main table of customer identity information, with customer number as the primary key or unique key and associated with sensitive fields such as name, ID number, mobile phone number, bank account number, and address, can be identified as the target sensitive table.

[0054] Table 1. Target Sensitive Table Field Mapping Table

[0055] The data semantics in Table 1 come from the sensitive data directory, and the field identifiers come from the metadata of the current data table. The identification server determines the associated anchor fields and sensitive fields according to the mapping shown in Table 1, and uses the associated anchor fields and sensitive fields to construct the table relationship diagram.

[0056] After the identification server completes the field mapping shown in Table 1, if an operator's session chain involves multiple target sensitive tables, the task progress status corresponds to the same maintenance work order, and the table splicing progress status is maintained separately according to the target sensitive tables; after the target sensitive tables are determined, the identification server proceeds to step S103.

[0057] Step S103: Update the task progress status of the actual operator based on the completion status of the task nodes in the maintenance work order.

[0058] The identification server extracts task operations and execution dependencies from the maintenance work order, and forms a task node sequence according to the execution dependency. The task node records the task operation identifier, required input data and completion mark. Task operations with parallel relationships are arranged in the order recorded in the work order.

[0059] The task progress status is represented by a set of completion markers for task nodes. The identification server sequentially reads the query results of the original query fragments and determines the first incomplete task node from the task node sequence. When the query results and work order execution records together provide the required input and completion evidence for the corresponding task node, the task node is marked as completed and the task progress status is updated.

[0060] The task progress status before the candidate query segment is executed is the set of completion markers before the query segment is executed, and the task progress status after execution is the set of completion markers after the query result is matched with the task node. Based on this, it is directly determined whether the query segment should be promoted to the maintenance work order. After the task progress status is updated, the identification server enters step S104.

[0061] Step S104: Update the table-building progress status of the target sensitive table based on the completion status of sensitive fields and record ranges of the target sensitive table according to the cross-sub-session query fragment set.

[0062] For the same target sensitive table and the connected parts of the same query segment, identify the associated anchor values ​​in the merged database query records that can be mapped to the target sensitive table, form a target anchor value set, and form the target record range according to the record range boundary of the original query segment; the same target anchor value set is used for full playback and strip playback.

[0063] The identification server sets the associated anchor field as the anchor node, the sensitive field as the field node, and sets the record range nodes according to the target record range to form a set of nodes to be completed; the same sensitive field creates field node instances in different record ranges, and the field node instance stores the sensitive field identifier, the corresponding record range, and the set of field overlay anchor values.

[0064] When the original query fragment executes successfully and retrieves the sensitive fields of the target sensitive table, the identification server checks whether the sensitive field results and the record range correspond to each record through the same associated anchor value. If the same result row or a result row that can be reconstructed through a key relationship contains both the associated anchor value and the sensitive field, the identification server writes the corresponding associated anchor value into the field overriding anchor value set of the corresponding field node instance. Only when the field overriding anchor value set equals the target anchor value set of the corresponding record range does the identification server establish a valid connection edge between the anchor node, the corresponding field node, and the corresponding record range node, forming... Figure 4The diagram shows the relationship between the tables. Each satisfying coverage relationship corresponds to two valid connection edges. The first valid connection edge connects the anchor node to the corresponding field node, and the second valid connection edge connects the corresponding field node to the corresponding record range node. Both valid connection edges record the same source original query fragment identifier and coverage anchor value set, so as to locate the original query fragment from the graph structure change. For results returned after the de-sensitization strategy and whose sensitive field content cannot be restored, the identification server does not write the corresponding associated anchor value to the field coverage anchor value set.

[0065] For example, the target anchor value set contains 100 numbers from 1058 to 1157. When the mobile phone number field first covers 99 numbers, the corresponding field node instance remains in a state of waiting to be filled. After the missing numbers are filled in by subsequent queries, the field covers the anchor value set and is equal to the target anchor value set, and the corresponding connection edge is established.

[0066] Starting from the anchor node, traverse the table-filling relationship graph and determine the anchor node, as well as the field nodes and record range nodes reached through the effective connection edges, as the effective completion node set. Then, the difference between the set of nodes to be filled and the effective completion node set is used to form the remaining set of nodes to be filled.

[0067] When the set of remaining nodes to be completed is empty, the recognition server updates the table-piece completion status to a closed state; when the set of remaining nodes to be completed is not empty, the recognition server updates the table-piece completion status to an unclosed state. A closed state indicates that the query results have covered the sensitive fields and target anchor value set of the target sensitive table, while an unclosed state indicates that at least one field node instance or record range node has not yet been effectively connected to the anchor node.

[0068] Save snapshots of the table concatenation graph and the table concatenation progress status after each update, according to the execution order of the original query fragments. The task progress status and the table concatenation progress status have the same query fragment order index, but are updated based on the maintenance work order and sensitive table structure data, respectively. This allows observation of the different effects of the same original query fragment on the two progress statuses, and proceeds to step S105 accordingly.

[0069] Step S105: Identify the divergent query segments from the cross-sub-session query segment set that represent the progress status of unprogressed tasks and change the table concatenation progress status from an open state to a closed state. A closed state indicates that the query results cover sensitive fields and record ranges. The specific determination process is as follows: Figure 5 As shown.

[0070] The identification server updates the table-building graph according to the execution order of the original query fragments. When the cross-sub-session query fragment set is completed and the table-building progress status is closed, the identification server determines the corresponding table-building graph as the final closed table-building graph. The final closed table-building graph contains all valid connection edges retained at the end of execution, and the parallel alternative connection paths formed successively are thus retained in the same table-building graph.

[0071] The identification server starts from the anchor node of the final closed table relationship graph, traverses to each field node and record range node, retains all connection paths from the anchor node to each field node and record range node and forms a set of connection paths, so that the alternative connection paths formed successively can enter the subsequent candidate range.

[0072] Read the source original query fragment identifier of each connection edge record in the connection path set, map the connection edge to the corresponding original query fragment, and form a candidate query fragment set. Then compare the task progress status before and after the execution of each candidate query fragment, and retain the candidate query fragments whose task node completion mark has not changed, forming a task-non-contributing query fragment set; the corresponding query fragments can still return data.

[0073] The set of query fragments that contribute nothing to the task is used to narrow down the scope to be verified. When the output of the candidate query fragment is indirectly used to complete the work order task in the subsequent original query fragments, a single state comparison may not yet reflect the effect of the delay. Steps S106 and S107 will replay the cross-sub-session query fragment set and the stripped query fragment sequence, respectively, and compare the final result of the first task with the result of the second task; when there is a delayed task contribution, the results of the two tasks are different, and step S108 will not generate an abnormal identity behavior identification result. Therefore, the local task progress state comparison is used for localization, and the final replay result is used to determine whether the stripped query fragments actually affect the work order task.

[0074] Virtual stripping is performed on a copy of the final closed patchwork graph. The identification server selects a combination of query fragments to be examined from the set of query fragments that contribute nothing to the task, removes the connecting edges generated by the query fragments to be examined, and recalculates the set of valid completed nodes and the set of remaining nodes to be completed. The final closed patchwork graph is closed when all query fragments are retained; it is not closed when all query fragments to be examined are stripped. Furthermore, the final closed patchwork graph remains closed when any proper subset of the query fragments to be examined is stripped. Based on this, the identification server determines the query fragments to be examined as a group of closed but broken fragments.

[0075] To represent the set conditions for closed and broken segment groups, the patchwork relationship graph and node set are defined as follows: (1) in, Represents the set of anchor nodes. Represents a collection of field nodes. E represents the set of nodes within the record range, and E represents the set of valid connecting edges established after the field coverage anchor value set in the final closed concatenation graph reaches the corresponding target anchor value set. The set of nodes to be supplemented, W, is determined by... , and Composition. The set of anchor nodes at the start of a breadth-first traversal. As the starting point for traversal, we enter the set of visited nodes, thus establishing the anchor node set. This belongs to the set of valid completion nodes. Each valid connection edge e stores the original query fragment identifier λe from its source. For any set of query fragments C to be stripped, the identification server removes connection edges from E whose source identifier belongs to C, and denotes the set of remaining connection edges as follows: The identification server is based on From the set of anchor nodes Perform a breadth-first traversal, and denote the reachable nodes as Reach. , And calculate the set of remaining nodes to be filled according to the following formula: (2) The identification server selects a set of query segments to be stripped from the set of query segments that contribute no to the task, and denotes the set of query segments to be stripped that meet the closure and disconnection conditions as . ; Set of query fragments to be stripped When the following formula is satisfied, the recognition server will Identified as a closed / broken segment group: (3) Equation (1) gives the node composition of the table relationship graph, Equation (2) applies to any set C of query segments to be stripped and gives the corresponding set of remaining nodes to be completed, Equation (3) uses C as an example. Represents a specific set of query segments to be stripped that meet the closure / break conditions, and is limited to complete state closure, unclosed after overall stripping, and still closed after stripping any proper subset; each parameter is a dimensionless set of nodes, connecting edges, or query segments.

[0076] To further illustrate the calculation process of equations (2) and (3), Table 2 provides exemplary test data when the original query fragments R1 and R2 form two alternative connection paths in the final closed concatenation relationship graph, where the bank account field node instance is the remaining node to be completed before this test is executed.

[0077] Table 2 Test data for the minimum stripping set algorithm

[0078] According to Table 2, when R1 is stripped alone, the path of R2 is retained, and when R2 is stripped alone, the path of R1 is retained. In both cases, the set of remaining nodes to be completed is empty. When R1 and R2 are stripped simultaneously, the bank account field node instance enters the set of remaining nodes to be completed. Therefore, {R1, R2} satisfies equation (3), and the identification server determines R1 and R2 as a closed broken segment group.

[0079] The identification server identifies the query segments within the closed / disconnected segment group as divergent query segments. A divergent query segment satisfies two conditions: the task progress state is the same before and after execution, and the table relationship graph changes from a closed state to an open state when the divergent query segment is stripped as part of the closed / disconnected segment group. Through this process, the divergent state where the task progress state remains unchanged while the table progress state tends to be closed is identified as a locatable query segment and its corresponding connection edge; after the divergent query segment is identified, the identification server proceeds to step S106.

[0080] Step S106: Replay the cross-sub-session query fragment set in the verification environment to obtain the first task result of the actual operator and the first table concatenation result of the target sensitive table.

[0081] The verification environment is isolated from the production database. A structural copy of the target sensitive tables and query dependency tables is created on the identified server, preserving field types, primary keys, unique keys, necessary foreign keys, and indexes required for queries. This copy is then written to non-production verification data to form a verification data snapshot.

[0082] Non-production validation data is generated based on query conditions, key relationships, and record range. Virtual values ​​replace production-sensitive field values, while maintaining primary and foreign key correspondences, sorting relationships, and record range boundaries, so that the original query fragments can be executed in the validation environment according to the original conditions.

[0083] The server identifies the parameter replacement mapping based on the field type and the source identifier of the bound parameter. The same source identifier is mapped to the same virtual value in all query fragments. Ordered fields are assigned virtual values ​​in the order of their original values, and the mapping results are saved as a snapshot to verify the bound parameters.

[0084] Before the formal replay, the identification server runs the original query segments one by one to check the execution status, result column identifiers and associated anchor value sets. After the check is consistent, a snapshot of the verification data is formed using the candidate verification data that has not been written into the trial run results. If the check is inconsistent and the verification data still cannot be consistent after adjustment, the verification status is recorded as not playable.

[0085] During replay, the time function, random function, sequence function, session variable return value, and transaction execution order used in the fixed query form the replay conditions; both full replay and stripped replay use the same verification data snapshot, parameter replacement mapping, and replay conditions.

[0086] The identification server replays the cross-sub-session query fragment set based on the verification data snapshot according to the replay conditions, and obtains the complete replay result. During the replay process, the query statement can only access non-production verification data in the verification environment. After each original query fragment is executed, the identification server updates the task progress status according to step S103, and updates the table assembly relationship diagram and table assembly progress status according to step S104.

[0087] The recognition server combines the task node completion mark set and completion evidence summary at the end of the full playback into the first task result, and combines the table-building progress status, the set of remaining nodes to be completed, and the table-building relationship graph summary into the first table-building result; after the first task result and the first table-building result are formed, the recognition server proceeds to step S107.

[0088] Step S107: After stripping the divergent query fragments, replay the remaining query fragments to obtain the second task result of the actual operator and the second table concatenation result of the target sensitive table.

[0089] First, the execution sequence of the original query fragments is copied, and an initial stripping set is formed using the divergent query fragments. Since subsequent query fragments may use the output of the divergent query fragments as binding parameters, the identification server calculates the dependency stripping set based on the binding parameter source identifier. During calculation, the identification server checks query fragments located after the initial stripping set in execution order; if any necessary binding parameter of a query fragment originates only from a query fragment in the current stripping set, and there is no identical parameter source in the work order input, validation data snapshot, or external fixed input, the corresponding query fragment is added to the current stripping set. The identification server repeats the check on subsequent query fragments until no new query fragments are added, and the final current stripping set is determined as the dependency stripping set.

[0090] For example, if the necessary input for query fragment T2 comes only from query fragment T1, T2 is added to the dependency stripping set after T1 is stripped; if the operation and maintenance work order or the verification data snapshot can provide the same input, T2 continues to be replayed.

[0091] The identification server sets a no-operation flag at the original execution position of each query fragment in the dependency stripping set, forming a sequence of stripped query fragments. The no-operation flag preserves the sequence position, transaction identifier, and transaction boundary of the original query fragments, but does not execute the original query statement, return sensitive fields, or add connection edges to the table relationship graph. The remaining query fragments that did not enter the dependency stripping set read a snapshot of the validation binding parameters; the source of these validation binding parameters is either work order input, validation data snapshot, external fixed input, or the result of a previous query that was not stripped. Therefore, the stripping operation does not change the relative order of the remaining query fragments, nor does it re-inject the result values ​​generated by the stripped query fragments into the remaining query fragments.

[0092] The identification server re-restores the verification data snapshot and replays the stripped query fragment sequence according to the same function return values ​​and transaction execution order as the full replay. Upon encountering a null operation marker, the identification server records the completion of the null operation and proceeds to the next sequence position; upon encountering a remaining query fragment, it executes the corresponding query based on the verification binding parameter snapshot from which the source was not stripped. When the completion evidence source identifier of a task node points to a query fragment in the dependency stripping set, the identification server does not update the second task result using the corresponding completion evidence. After replay, the second task result is formed based on the completion marker set of the task node sequence and the completion evidence summary corresponding to each completion marker; the second table concatenation result is formed based on the table concatenation progress status, the set of remaining nodes to be completed, and the table concatenation relationship graph summary.

[0093] like Figure 6 As shown, both full replay and stripped replay start from the same verification data snapshot and use the same replay conditions. The controlled difference between the two replays is whether the divergent query segments and dependent stripped segments that cannot be executed independently due to missing input for the divergent query segments are executed; the remaining query segments with independent input sources remain unchanged. The identification server obtains the first task result, the first table concatenation result, the second task result, and the second table concatenation result, and passes the corresponding results to step S108, where step S108 performs the final determination. This verification process applies to the table structure copy, the cross-sub-session query segment set, the stripped query segment sequence, and the status results. It does not require personnel to re-operate, nor does it rely on personnel's answers to inquiries or personnel behavioral tendencies as verification criteria.

[0094] Step S108: If the result of the first task is the same as the result of the second task, the result of the first table concatenation is closed and the result of the second table concatenation is not closed, generate the abnormal identity behavior identification result of the actual operator and the data leakage risk identification result of the target sensitive table.

[0095] The server compares the task node completion marker sets and corresponding completion evidence summaries in the first and second task results. If the task node identifier, completion marker, and completion evidence summary are identical item by item, the server determines that the first and second task results are the same. The server reads the piecing progress status from the first and second piecing results; if the first piecing result is closed and the second piecing result is open, the server determines that the missing deviation query fragment and corresponding dependency stripping fragment have not changed the work order task result, and that the sensitive fields and record range of the target sensitive table have changed from complete coverage to incomplete coverage.

[0096] When the three conditions of step S108 are met, the abnormal identity behavior identification result records the real-name login identifier, operator session chain identifier, deviation query fragment identifier, and verification result identifier; the data leakage risk identification result records the target sensitive table identifier, the supplemented sensitive fields, the target record range, and a summary of the table relationship diagram of the two replays.

[0097] When there is a difference between the results of the first and second tasks, the replay record is marked as "stripping the query segment affects the work order task result." When the first table concatenation result is in an open state, the replay record is marked as "the complete query process has not yet covered sensitive fields and record ranges." When the second table concatenation result is still in a closed state, the replay record is marked as "selecting the deviating query segment has not changed the closed state of the table concatenation relationship graph." The above replay records enter the subsequent audit process, and the identification result of step S108 remains in an ungenerated state.

[0098] For example, a maintenance work order is used to verify a batch of customer data import failures. The task nodes are, in sequence, obtaining the information of the failed batch, checking the import status, and verifying the repair results. Maintenance personnel log in with their real names from the same terminal and form database sub-sessions B1 to B4 in succession. The identification server identifies B1, which contains the real-name login identifier, as the real-name anchored sub-session.

[0099] In query segment Q1 of B1, the virtual batch number B24 and customer number 1058 are obtained. The successful query status and the batch number constitute the completion evidence of the first task node. B2 uses the customer number 1058 returned by Q1 as a binding parameter. The source identifier of the binding parameter points to the result unit of Q1. Therefore, customer number 1058 constitutes the data connecting B1 and B2.

[0100] In B2, Q2 retrieves the name and ID number from the range of customer ID 1058 to 1157. In B3, Q3 uses the last customer ID 1157 returned by Q2 as a page cursor to retrieve the same field from the range of 1158 to 1257. In B4, Q4 retrieves the mobile phone number, bank account number, and address from the range of 1058 to 1257. All of the above data is non-production verification data.

[0101] The identification server establishes a directional connection relationship between B1 and B4 based on the received data, forming an operator session chain that can be traced back to B1, and the actual operator P01 is identified by the real-name login identifier of B1; the record ranges of Q2 and Q3 are adjacent, and Q3 and Q4 have an input-output connection relationship, and the corresponding query fragments are thus connected.

[0102] The main table of customer identity information uses the customer number as the unique key. The name, ID number, mobile phone number, bank account number and address are marked as sensitive fields, and therefore it is identified as the target sensitive table. The identification server establishes two record ranges and corresponding field node instances based on the query boundary of 1058 to 1257.

[0103] After Q2 and Q3 are executed, the name and ID number cover two record ranges respectively, while the mobile phone number, bank account number and address are still in the state of being to be completed, and the table concatenation progress status is in the unclosed state; after Q4 is executed, the latter three fields cover 200 target anchor point values, the set of remaining nodes to be completed becomes an empty set, and the table concatenation progress status turns into the closed state for the first time.

[0104] Q2 through Q4 did not provide the import status and failure reason required for the first incomplete task node. The task progress status remained unchanged before and after execution. Therefore, Q2 through Q4 entered the task non-contribution query fragment set. Among them, the connection edge generated in Q4 participated in the formation of the final closed table relationship graph.

[0105] After the virtual stripping of the connection edges generated by Q4, the field node instances corresponding to the mobile phone number, bank account number, and address re-enter the set of remaining nodes to be completed. The table relationship graph becomes unclosed, and Q4 thus constitutes a closed disconnected segment group and is identified as a divergent query segment.

[0106] The verification environment generates 200 virtual records corresponding to customer numbers 1058 to 1257 and forms a verification data snapshot; the results of the first task obtained by fully replaying Q1 to Q4 are the same as the results of the second task obtained by replaying Q1 to Q3 after removing Q4. The first table concatenation result is in a closed state and the second table concatenation result is in an unclosed state. Based on this, the identification server generates the abnormal identity behavior identification result of P01 and the data leakage risk identification result of the customer identity information master table.

[0107] As another example, the read-type query fragment R1 first directly accesses the target sensitive table and forms a connection path pointing to the bank account number field node instance. The read-type query fragment R2 then returns the bank account number field within the same record range through a business view that can be mapped to the target sensitive table and forms another connection path pointing to the same field node instance. After the cross-subsession query fragment set is completed, the two alternative connection paths are retained together in the final closed table relationship graph.

[0108] When R1 or R2 is stripped individually, the other connection path still keeps the final closed patchwork graph closed; when R1 and R2 are stripped at the same time, the bank account field node instance enters the set of remaining nodes to be completed, and the final closed patchwork graph becomes unclosed. Therefore, R1 and R2 form a closed broken fragment group.

[0109] The task progress states before and after execution of R1 and R2 are the same, so they are included in the set of query segments that do not contribute to the task. Under the same verification data snapshot and playback conditions, after simultaneously stripping R1 and R2, when the result of the first task is the same as the result of the second task and the table concatenation result changes from closed to open, the recognition server will jointly identify R1 and R2 as divergent query segments.

[0110] If the verification data snapshot construction fails, the full replay execution fails, the data structure versions used in the two replays are inconsistent, or the replay conditions cannot be fixed, the identification server records the reason for the verification failure and does not treat the incomplete verification result as the result of abnormal identity behavior identification. After the verification environment is restored to a consistent structure version, steps S106 to S108 can be re-executed based on the same cross-sub-session query fragment set.

[0111] Based on the aforementioned method, this embodiment also provides an AI-based identification system for internal abnormal identity behavior and data leakage risks. The identification system includes a data attribution construction module, a dual-progress analysis module, a deviation location module, and a replay verification and risk output module. Each module is implemented by a processor executing computer programs stored in memory, and the processing results are transmitted in the order of data attribution construction, dual-progress update, deviation location, and replay verification.

[0112] The data attribution construction module receives operation and maintenance access records, database query records, operation and maintenance work orders, and sensitive table structure data. It first associates the operation and maintenance access records with the database query records to determine the actual operator. Then, based on the database query records, it forms a set of cross-sub-session query fragments for the actual operator and determines the target sensitive table based on the sensitive table structure data. The data attribution construction module outputs the actual operator, the set of cross-sub-session query fragments, the operation and maintenance work orders, and the target sensitive table. This consolidates query records scattered across different database sub-sessions into a single analysis object and provides a data foundation with a unified query order for the dual-progress analysis module.

[0113] The dual-progress analysis module receives the actual operator, cross-sub-session query fragment set, maintenance work order, and target sensitive table from the data attribution construction module. On one hand, the dual-progress analysis module updates the task progress status of the actual operator according to the completion status of the task nodes in the maintenance work order, following the execution order of the query fragments. On the other hand, the dual-progress analysis module updates the table-completion progress status of the target sensitive table according to the completion status of sensitive fields and record ranges in each query fragment, following the execution order of the same query fragment. The dual-progress analysis module maps the two progress statuses to the execution position of the same query fragment and provides both progress statuses to the divergence localization module, enabling the divergence localization module to compare the different impacts of the same query fragment on the maintenance task and the sensitive data completion process.

[0114] The deviation location module receives a set of cross-sub-session query fragments, task progress status, and table assembly progress status. From the cross-sub-session query fragment set, it identifies deviation query fragments that indicate unprogressed task progress status and cause the table assembly progress status to change from an open to a closed state. The deviation location module outputs the deviation query fragments and the set of cross-sub-session query fragments, and provides both to the replay verification and risk output module. This processing limits the objects to be verified to query fragments that do not contribute to the progress of the operation and maintenance task but ensure complete coverage of sensitive fields and record ranges.

[0115] The replay verification and risk output module receives divergent query fragments and cross-sub-session query fragment sets. In the same verification environment, it first replays the cross-sub-session query fragment set to obtain the first task result and the first table concatenation result. Then, it removes the divergent query fragments and replays the remaining query fragments to obtain the second task result and the second table concatenation result. The replay verification and risk output module compares the first task result with the second task result, and also compares the first table concatenation result with the second table concatenation result. When the first and second task results are the same, the first table concatenation result is closed, and the second table concatenation result is open, the replay verification and risk output module generates an abnormal identity behavior identification result for the actual operator and a data leakage risk identification result for the target sensitive table. Thus, the system first locates divergent query fragments through query records, then confirms the different roles of the divergent query fragments on the task results and table concatenation results through data layer replay. The risk identification results correspond to the actual operator, the divergent query fragments, and the target sensitive table.

[0116] The above embodiments are used to illustrate the technical solution of this example. Those skilled in the art can make corresponding adjustments without changing the input-output relationship and judgment conditions of each step.

Claims

1. An AI-based method for identifying internal abnormal identity behavior and data leakage risks, characterized in that, include: Obtain operation and maintenance access records, database query records, operation and maintenance work orders, and sensitive table structure data; associate the operation and maintenance access records with the database query records to determine the actual operator. The database query records are used to form a set of cross-sub-session query fragments for the actual operator, and the target sensitive table is determined based on the sensitive table structure data. Update the task progress status of the actual operator based on the completion status of the task nodes of the maintenance work order. Update the table-building progress status of the target sensitive table based on the completion status of sensitive fields and record range of the target sensitive table according to the cross-sub-session query fragment set; From the set of cross-sub-session query fragments, determine the progress status of the unadvanced task and change the table-binding progress status from an unclosed state to a closed state. The closed state indicates that the query results cover the sensitive fields and record range. In the verification environment, the cross-sub-session query fragment set is replayed to obtain the first task result of the actual operator and the first table concatenation result of the target sensitive table. After stripping the divergent query segment, the remaining query segment is replayed to obtain the second task result of the actual operator and the second table concatenation result of the target sensitive table; If the result of the first task is the same as the result of the second task, the first table concatenation result is in a closed state and the second table concatenation result is in an unclosed state, an abnormal identity behavior identification result of the actual operator and a data leakage risk identification result of the target sensitive table are generated.

2. The method according to claim 1, characterized in that, The association of the operation and maintenance access records and the database query records to determine the actual operator includes: The real-name anchored sub-session is determined based on the real-name login identifier in the operation and maintenance access record; Based on the access terminal identifier and access time of the real-name anchored sub-session, candidate database sub-sessions are selected from the operation and maintenance access records; Extract the query input data and query result data of each candidate database sub-session from the database query records to form session input and output data; From the session input and output data, the data that exists only in the query result data of the previous candidate database sub-session and is used as query input data by the next candidate database sub-session is determined as the successor data; Based on the received data, a directed acceptance relationship is established between the previous candidate database sub-session and the next candidate database sub-session; Connect to the real-name anchored sub-session along the directional connection relationship to form an operator session chain, and determine the person corresponding to the operator session chain based on the real-name login identifier corresponding to the operator session chain, and determine the person corresponding to the operator session chain as the actual operator.

3. The method according to claim 2, characterized in that, The step of forming the cross-sub-session query fragment set for the actual operator based on the database query records includes: Arrange each candidate database sub-session according to the directional acceptance relationship in the operator session chain to obtain the sub-session sequence; The table identifier, field identifier, associated anchor field, record range, and continuation data are extracted sequentially from the database query records corresponding to the sub-session sequence to form the original query fragment; Establish the query segment connection relationship based on the input and output data of each original query segment; Set a break marker between adjacent original query segments that have not established the connection relationship between the query segments; If a subsequent original query segment uses the data inherited from the previous original query segment, or if the starting anchor value of the record range of the subsequent original query segment is adjacent to the ending anchor value of the record range of the previous original query segment in the sorting order of the associated anchor field, the corresponding disconnection marker will be replaced with the query segment connection relationship. A cross-subsession query fragment set is formed based on each original query fragment, the connection relationship of the query fragments, and the remaining disconnect markers.

4. The method according to claim 3, characterized in that, The step of updating the table-building progress status of the target sensitive table based on the completion status of sensitive fields and record ranges of the target sensitive table according to the cross-sub-session query fragment set includes: Set the associated anchor field of the target sensitive table as an anchor node, set the sensitive field of the target sensitive table as a field node, and set the record range node according to the record range boundary of the cross-sub-session query fragment set to form a set of nodes to be completed. If the sensitive fields and record ranges obtained from the original query fragment correspond to the same associated anchor value, a connection edge is established between the anchor node, the corresponding field node, and the corresponding record range node to form a table relationship graph. Extract the anchor node, field node and record range node that are in the same connected part as the anchor node from the table relationship graph to form an effective set of completion nodes; The remaining set of nodes to be filled is formed by the difference between the set of nodes to be filled and the set of valid nodes to be filled. If the set of remaining nodes to be completed is empty, the table completion progress status is updated to closed; if the set of remaining nodes to be completed is not empty, the table completion progress status is updated to unclosed.

5. The method according to claim 4, characterized in that, The divergent query fragments that determine the progress status of unadvanced tasks from the cross-sub-session query fragment set and change the table-binding progress status from an open state to a closed state include: The final closed concatenation graph is determined as the concatenation graph when the cross-sub-session query fragment set is completed. Extract all connection paths from the anchor node to each field node and record range node from the final closed table relationship graph to form a set of connection paths; Map the connection edges in the set of connection paths to the corresponding original query fragments to form a set of candidate query fragments; Compare the task progress status before and after the execution of each candidate query segment, and retain the candidate query segments with the same task progress status before and after execution from the candidate query segment set to form a set of query segments that do not contribute to the task. The closed and broken segment groups are determined based on the results of virtual stripping of the query segments in the set of query segments that do not contribute to the task. When all the closed and broken segment groups are retained, the final closed table relationship graph is in a closed state. When all the closed and broken segment groups are stripped, the final closed table relationship graph is in an unclosed state. When any proper subset of the closed and broken segment groups is stripped, the final closed table relationship graph is still in a closed state. The query segment in the closed and disconnected segment group is identified as the divergent query segment.

6. The method according to claim 3, characterized in that, The step of determining the target sensitive table based on the sensitive table structure data includes: Extract the key relationships and sensitive field markers of each data table from the sensitive table structure data to form data table association data; Based on the associated data in the data table, the main table containing customer identity information, which uses the customer ID field as the primary key or unique key and is associated with the name field, ID number field, mobile phone number field, bank account field, and address field, is identified as the target sensitive table.

7. The method according to claim 4, characterized in that, The step of updating the task progress status of the actual operator based on the completion status of the task nodes of the maintenance work order includes: A sequence of task nodes is formed based on the task operations and execution dependencies between the task operations in the maintenance work order. Identify the first incomplete task node from the sequence of task nodes; If the query results in the cross-sub-session query fragment set and the execution record of the operation and maintenance work order together provide the input data and completion evidence required for the first incomplete task node, the first incomplete task node is marked as completed, and the task progress status is updated according to the completion mark.

8. The method according to claim 5, characterized in that, The step of replaying the cross-sub-session query fragment set in the verification environment to obtain the first task result of the actual operator and the first concatenation result of the target sensitive table includes: In the verification environment, a copy of the target sensitive table structure is created and non-production verification data is written to form a verification data snapshot; Fixed function return values ​​and transaction execution order form replay conditions; According to the replay conditions, the cross-sub-session query fragment set is replayed based on the verification data snapshot to obtain the complete replay result; Based on the complete playback results, the first task result of the actual operator and the first composite result of the target sensitivity table are determined.

9. The method according to claim 8, characterized in that, After stripping the divergent query fragments, the remaining query fragments are replayed to obtain the second task result of the actual operator and the second table concatenation result of the target sensitive table, including: A no-operation marker is set at the original execution position of the deviated query segment to form a sequence of stripped query segments; According to the replay conditions, the stripped query fragment sequence is replayed based on the verification data snapshot to obtain the second task result and the second table concatenation result.

10. An AI-based system for identifying internal abnormal identity behavior and data leakage risks, characterized in that, include: The data attribution construction module is used to obtain operation and maintenance access records, database query records, operation and maintenance work orders and sensitive table structure data, and associate the operation and maintenance access records and the database query records to determine the actual operator; The data attribution construction module is also used to form a cross-sub-session query fragment set of the actual operator based on the database query records, determine the target sensitive table based on the sensitive table structure data, and provide the actual operator, the cross-sub-session query fragment set, the operation and maintenance work order and the target sensitive table to the dual progress analysis module; The dual-progress analysis module is used to update the task progress status of the actual operator according to the task node completion status of the maintenance work order and the execution order of the query segments in the cross-sub-session query segment set. The dual-progress analysis module is also used to update the table-building progress status of the target sensitive table according to the execution order of the query segments based on the completion status of the sensitive fields and record range of the target sensitive table by the cross-sub-session query fragment set, and to provide the task progress status and the table-building progress status to the deviation positioning module. The divergence positioning module is used to determine from the cross-sub-session query fragment set the divergence query fragments that have not advanced the task progress status and have changed the table splicing progress status from an open state to a closed state. The closed state indicates that the query result covers the sensitive field and the record range. The deviation positioning module is also used to provide the deviation query fragment and the cross-sub-session query fragment set to the replay verification and risk output module. The replay verification and risk output module is used to replay the cross-sub-session query fragment set in the verification environment, and replay the remaining query fragments after stripping the divergent query fragments, to obtain the first task result and the second task result of the actual operator, as well as the first and second table concatenation results of the target sensitive table. The replay verification and risk output module is also used to generate the abnormal identity behavior identification result of the actual operator and the data leakage risk identification result of the target sensitive table when the first task result and the second task result are the same, the first table concatenation result is in a closed state and the second table concatenation result is in an unclosed state.

Images