Database auditing system and method based on clustering analysis and association rules

Abstract

The invention discloses a database auditing system and method based on clustering analysis and association rules, and relates to database auditing. The data acquisition probes are used for acquiring and outputting user data and behavior data; the first audit analysis module is used for identifying the user data by the machine learning model to obtain a user portrait, outputting a first analysis result when the user portrait is a normal user, otherwise, outputting a second analysis result; the second audit analysis module is used for matching the behavior data of the first analysis result witha rule base, outputting a third analysis result when matching is carried out, and outputting a fourth analysis result when matching cannot be carried out; the first alarm unit generates first alarm information according to the second analysis result; the second alarm unit generates second alarm information according to the fourth analysis result; and the audit report module generates an audit report according to the third analysis result, the first alarm information and the second alarm information. The performance of the database is improved, a guarantee is provided for safe operation of thedatabase, and real-time auditing and safety detection are achieved.

Description

technical field [0001] The invention relates to the field of database auditing, in particular to a database auditing system and method based on cluster analysis and association rules. Background technique [0002] The database audit system is mainly used to monitor and record various operations on the database server. Through the analysis of network data, it can analyze various operations on the database server in real time and intelligently, and record them in the audit database for future query. Analyze and filter to realize the monitoring and auditing of user operations of the target database auditing system. At present, the security mechanism of the database audit system includes: identification and authentication, access control, access control, encryption, backup and recovery, reasoning control and privacy protection, and database auditing. The defense-based passive security mechanism cannot fully meet the security requirements of the database. The database audit sys...

AI Technical Summary

Problems solved by technology

At present, the security mechanism of the database audit system includes: identification and authentication, access control, access control, encryption, backup and recovery, reasoning control and privacy protection, and database auditing. The defense-based passive security mechanism cannot fully meet the security requirements of the database

The database audit system is a complex and critical system, and there are various management and technical risks. If these risks become reality, the enterprise data will suffer serious economic losses and legal risks. It is very difficult to trace and deal with database security problems. Locating, because traces and evidence of the problem cannot be found

Therefore, the database security real-time audit system has become a popular technology at present. This is a defense technology based on dynamic security, but there are certain limitations in practical applications. For example, if only coarse-grained auditing is implemented, it is difficult to detect intrusion and attack behavior However, fine-grained auditing may seriously affect the performance of the database, so it is very necessary to implement fine-grained auditing without affecting the performance of the database too much

Images