CN115630068A - Abnormal data table determining method, device, equipment and storage medium - Google Patents
Abnormal data table determining method, device, equipment and storage medium Download PDFInfo
- Publication number
- CN115630068A CN115630068A CN202211327239.0A CN202211327239A CN115630068A CN 115630068 A CN115630068 A CN 115630068A CN 202211327239 A CN202211327239 A CN 202211327239A CN 115630068 A CN115630068 A CN 115630068A
- Authority
- CN
- China
- Prior art keywords
- character information
- data table
- window
- abnormal
- target
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/22—Indexing; Data structures therefor; Storage structures
- G06F16/2282—Tablespace storage structures; Management thereof
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
- G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
- G06F21/6227—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database where protection concerns the structure of data, e.g. records, types, queries
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N20/00—Machine learning
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/08—Learning methods
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Software Systems (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Data Mining & Analysis (AREA)
- Mathematical Physics (AREA)
- Evolutionary Computation (AREA)
- Databases & Information Systems (AREA)
- General Health & Medical Sciences (AREA)
- Computing Systems (AREA)
- Health & Medical Sciences (AREA)
- Artificial Intelligence (AREA)
- Medical Informatics (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Bioethics (AREA)
- Life Sciences & Earth Sciences (AREA)
- Biomedical Technology (AREA)
- Biophysics (AREA)
- Computational Linguistics (AREA)
- Molecular Biology (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
The invention discloses a method, a device, equipment and a storage medium for determining an abnormal data table. The method comprises the following steps: acquiring abnormal character information and table name information of a data table to be detected, wherein the table name information consists of at least one character information; dividing the table name information according to a preset window length and a preset step length to obtain character information in at least one window; and determining whether the data table to be detected is an abnormal data table or not according to the character information in each window and the abnormal character information. According to the embodiment of the invention, the table name information of the data table to be detected is divided by using the sliding window algorithm, so that the abnormal data table can be accurately and quickly found, the abnormal data table is further managed and controlled, the data safety is maintained and ensured, the early warning and identification capability of the data safety is improved, the hidden danger is found and processed in time, and the threat of the data safety risk is reduced.
Description
Technical Field
The present invention relates to the field of data security technologies, and in particular, to a method, an apparatus, a device, and a storage medium for determining an abnormal data table.
Background
With the development of business, sensitive tables in an IT system are more and more, but because the data of a production system is changed quickly, scanning all databases cannot find newly-added sensitive data tables in real time, which may cause that many potential sensitive tables cannot be brought into management and control in time, and a larger potential safety hazard exists.
Disclosure of Invention
The invention provides a method, a device, equipment and a storage medium for determining an abnormal data table, which are used for solving the problem of great potential safety hazard caused by the fact that a newly added sensitive data table cannot be found in real time in the prior art.
According to an aspect of the present invention, there is provided an abnormal data table determination method, including:
acquiring abnormal character information and table name information of a data table to be detected, wherein the table name information consists of at least one character information;
dividing the table name information according to a preset window length and a preset step length to obtain character information in at least one window;
and determining whether the data table to be detected is an abnormal data table or not according to the character information in each window and the abnormal character information.
According to another aspect of the present invention, there is provided an abnormal data table determining apparatus including:
the system comprises an acquisition module, a storage module and a display module, wherein the acquisition module is used for acquiring abnormal character information and table name information of a data table to be detected, and the table name information consists of at least one character information;
the dividing module is used for dividing the table name information according to the preset window length and the preset step length to obtain character information in at least one window;
and the determining module is used for determining whether the data table to be detected is an abnormal data table according to the character information in each window and the abnormal character information.
According to another aspect of the present invention, there is provided an electronic apparatus including:
at least one processor; and a memory communicatively coupled to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, the computer program being executable by the at least one processor to enable the at least one processor to perform the method of determining an abnormal data table according to any of the embodiments of the present invention.
According to another aspect of the present invention, there is provided a computer-readable storage medium storing computer instructions for causing a processor to implement the method for determining an abnormal data table according to any one of the embodiments of the present invention when the computer instructions are executed.
According to the technical scheme, the abnormal character information and the table name information of the data table to be detected are obtained, wherein the table name information is composed of at least one character information, the table name information is divided according to the length of a preset window and the preset step length to obtain the character information in the at least one window, and whether the data table to be detected is the abnormal data table or not is determined according to the character information and the abnormal character information in each window. According to the technical scheme of the embodiment of the invention, the abnormal data table can be accurately and quickly found by dividing the table name information of the data table to be detected by using the sliding window algorithm, so that the abnormal data table is controlled, the problem of large potential safety hazard caused by the fact that newly added sensitive data tables cannot be found in real time in the prior art is solved, the maintenance and the data safety guarantee are realized, the data safety early warning and identifying capability is improved, the potential safety hazard is found in time, the potential safety hazard is treated, and the threat of the data safety risk is reduced.
It should be understood that the statements in this section do not necessarily identify key or critical features of the embodiments of the present invention, nor do they necessarily limit the scope of the invention. Other features of the present invention will become apparent from the following description.
Drawings
In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings needed to be used in the description of the embodiments will be briefly introduced below, and it is obvious that the drawings in the following description are only some embodiments of the present invention, and it is obvious for those skilled in the art to obtain other drawings based on these drawings without creative efforts.
FIG. 1 is a flowchart of an abnormal data table determination method according to an embodiment of the present invention;
FIG. 2 is a schematic structural diagram of an abnormal data table determination apparatus according to a second embodiment of the present invention;
fig. 3 is a schematic structural diagram of an electronic device implementing the abnormal data table determination method according to the embodiment of the present invention.
Detailed Description
In order to make the technical solutions of the present invention better understood, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
It should be noted that the terms "first," "target," and the like in the description and claims of the present invention and in the above-described drawings are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used is interchangeable under appropriate circumstances such that the embodiments of the invention described herein are capable of operation in sequences other than those illustrated or described herein. Furthermore, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed, but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.
Example one
Fig. 1 is a flowchart of an abnormal data table determination method according to an embodiment of the present invention, where the embodiment is applicable to an abnormal data table determination situation, and the method may be implemented by an abnormal data table determination apparatus, where the abnormal data table determination apparatus may be implemented in a form of hardware and/or software, and the abnormal data table determination apparatus may be integrated in any electronic device that provides an abnormal data table determination function. As shown in fig. 1, the method includes:
s101, obtaining abnormal character information and table name information of the to-be-detected data table.
In this embodiment, the table name information of the abnormal data table may be composed of at least one character information, and in this embodiment, the character information may be a chinese character, an english character, an underline, or other symbolic characters that constitute the table name information, which is not limited in this embodiment. The abnormal character information may be character sequence information included in table name information for the abnormal data table as a comparison reference of the table name information of the data table to be detected. Illustratively, the table name information of a certain abnormal data table is abcde, the table name information abcde _123 of a certain data table to be detected is compared with the table name information abcde of the abnormal data table, whether the data table to be detected is the abnormal data table is judged, and the table name information abcde of the abnormal data table is the abnormal character information. Specifically, the abnormal character information may be set by the user, or may be acquired from a database storing all data tables, which is not limited in this embodiment.
In this embodiment, the data table to be detected may be an acquired data table to be detected whether the acquired data table is an abnormal data table. The table name information of the data table to be detected is composed of at least one character information. Illustratively, the data table to be detected may be a data table newly added to a database for storing all data tables, so that the newly added data table in the database can be detected in real time, and then an abnormal data table can be accurately and quickly found and managed.
Specifically, the abnormal character information is obtained and used as a comparison standard of the data table to be detected, and the table name information of the data table to be detected is obtained, wherein the table name information of the data table to be detected is composed of at least one character information. Illustratively, the abnormal character information may be abcde, and the table name information of the data table to be detected may be abcde _123.
S102, the table name information is divided according to the preset window length and the preset step length, and character information in at least one window is obtained.
In this embodiment, the preset window length may be a character length of a sliding window set by the user according to the number of character sequences of the abnormal character information. For example, the number of characters of the characters in the abnormal character information may be 5, and the preset window length of the sliding window may be 3 character lengths. The preset step size may be a character step size of each sliding of the sliding window set by the user according to the number of characters of the abnormal character information. For example, the number of characters of the characters in the abnormal character information may be 5, and the preset step size of the sliding window may be 1 character length.
It should be noted that the dividing operation may be dividing the character information included in the table name information of the data packet to be detected into a plurality of characters with preset window lengths by using a sliding window algorithm. In the implementation process, the sliding window algorithm in this embodiment may be a horizontal sliding window algorithm.
The character information in the window may be character sequence information in each sliding window obtained by dividing the table name information of the data packet to be detected by a sliding window algorithm.
Specifically, the character information contained in the table name information of the data packet to be detected is divided through a sliding window algorithm according to the preset window length and the preset step length, so that the character information in at least one window is obtained. Illustratively, the table name information of an abnormal data table is abcde, that is, the character sequence contained in the table name information of the abnormal data table is [ a, b, c, d, e ], and the table name information of the data table to be detected may be abcde _123, that is, the character sequence contained in the table name information of the detected data table is [ a, b, c, d, e, _,1,2,3]. Assuming that the set preset window length is 3 and the preset step length is 1, dividing character information included in table name information of a data packet to be detected according to the preset window length and the preset step length through a sliding window algorithm to obtain 7 windows, where the obtained character sequence information in all the windows may be: window 1[ 2], [ a, b, c ], window 2[ b, c, d ], window 3[ c, d, e ], window 4[ d, e ], window 5[e [ alpha ], 1], window 6[ alpha ], 1,2] and window 7[ 2,3].
S103, determining whether the data table to be detected is an abnormal data table or not according to the character information and the abnormal character information in each window.
In this embodiment, the abnormal data table may be a data table in which the table contains abnormal data.
Specifically, the character information in each window is compared with the abnormal character information, so as to determine whether the data table to be detected is an abnormal data table.
According to the technical scheme, the abnormal character information and the table name information of the data table to be detected are obtained, wherein the table name information is composed of at least one character information, the table name information is divided according to the length of a preset window and the preset step length to obtain the character information in the at least one window, and whether the data table to be detected is the abnormal data table or not is determined according to the character information and the abnormal character information in each window. According to the technical scheme of the embodiment of the invention, the abnormal data table can be accurately and quickly found by dividing the table name information of the data table to be detected by using the sliding window algorithm, so that the abnormal data table is controlled, the problem of large potential safety hazard caused by the fact that newly added sensitive data tables cannot be found in real time in the prior art is solved, the maintenance and the data safety guarantee are realized, the data safety early warning and identifying capability is improved, the potential safety hazard is found in time, the potential safety hazard is treated, and the threat of the data safety risk is reduced.
Optionally, determining whether the data table to be detected is an abnormal data table according to the character information and the abnormal character information in each window, including:
and inputting the abnormal character information and the character information in each window into a machine learning model to obtain a target score corresponding to the character information in each window.
In this embodiment, a machine learning model may be used to identify a similarity score between the character information and the abnormal character information within each window.
The machine learning model is obtained by iteratively training a neural network model through a target sample set.
In this embodiment, the target sample set may be a sample set used for training a neural network model to obtain a machine learning model, and the target sample set includes at least one target sample.
Wherein the target sample comprises: abnormal character information, character information samples and detection scores corresponding to the character information samples.
It should be noted that the character information sample may be a character information sample used for training the neural network model to obtain the machine learning model, and the detection score corresponding to the character information sample may be a similarity score between the character information sample and the abnormal character information.
It should be noted that the target score may be a similarity score between the character information and the abnormal character information in each window. Illustratively, the table name information of a certain abnormal data table is abcde, the table name information of the data table to be detected may be abcde _123, and if the preset window length is 3 and the preset step length is 1, the character information included in the table name information of the data packet to be detected is divided according to the preset window length and the preset step length by using a sliding window algorithm, so as to obtain 7 windows: window 1[ 2], [ a, b, c ], window 2[ b, c, d ], window 3[ c, d, e ], window 4[ d, e ], window 5[e, [ 1], window 6[ lambda ], 1,2] and window 7[1,2,3]. In the 7 windows, the character information and the abnormal character information in the window 1, the window 2 and the window 3 are completely the same, and the target score corresponding to the character information in the window 1, the window 2 and the window 3 can be 100 scores; if the character information and the abnormal character information in the window 6 and the window 7 are completely different, the target score corresponding to the character information in the window 6 and the window 7 may be 0; the target scores corresponding to the character information in the other windows can be determined according to the similarity between the character information and the abnormal character information in each window.
Specifically, the abnormal character information, the character information samples and the detection scores corresponding to the character information samples form a target sample set, the target sample set is input into a neural network model, and the trained machine learning model is obtained through iterative training. And inputting the abnormal character information and the character information in each window into a machine learning model to obtain a target score corresponding to the character information in each window.
And determining whether the data table to be detected is an abnormal data table or not according to the target score.
Specifically, whether the character information in each window is similar to the abnormal character information or not is determined according to the target score corresponding to the character information in each window, and whether the data table to be detected is the abnormal data table or not is determined according to the number of the windows in which the character information in each window is similar to the abnormal character information.
Optionally, determining whether the data table to be detected is an abnormal data table according to the target score includes:
and determining a target window according to the target score and a preset score threshold value.
The preset score threshold may be set by the user according to the actual situation, which is not limited in this embodiment. In the actual operation process, the preset score threshold value can be set by the user according to the similarity between the character information and the abnormal character information in each window. For example, the preset score threshold may be 85 points.
It should be explained that the target window may be a window in which the similarity score between the character information in the window and the abnormal data table information, that is, the target score corresponding to the character information in the window, is greater than or equal to a preset score threshold.
Wherein, the character information in the target window belongs to the abnormal data table information.
The abnormal data table information may be character information included in table name information of the abnormal data table.
Specifically, the target score is compared with a preset score threshold value, so as to determine a target window where the target score corresponding to the character information in the window is greater than or equal to the preset score threshold value, where the character information in the target window belongs to the abnormal data table information, that is, the similarity between the character information in the target window and the character information included in the table name information of the abnormal data table is high.
And acquiring the number of the target windows.
Specifically, the number of target windows with target scores greater than or equal to a preset score threshold is obtained.
And determining whether the data table to be detected is an abnormal data table or not according to the number of the target windows and a preset threshold value of the number of the target windows.
The preset target window number threshold may be set by the user according to the actual situation, which is not limited in this embodiment. In the actual operation process, the preset target window number threshold may be set by the user according to the number of windows obtained by dividing the table name information, and specifically, the number of windows obtained by dividing the table name information may be determined by the number of characters of the abnormal character information, the number of characters included in the table name information of the data table to be detected, the preset window length, and the preset step length. For example, if the number of windows obtained by dividing the table name information is 10, the preset target window number threshold may be 7.
Specifically, the number of the target windows is compared with a preset target window number threshold value, so that whether the data table to be detected is an abnormal data table or not is determined.
Optionally, determining the target window according to the target score and a preset score threshold includes:
and if the target score is greater than or equal to the preset score threshold value, determining the window as the target window.
Specifically, if the target score corresponding to the character information in a certain window is greater than or equal to the preset score threshold, the window is determined as the target window, that is, the character information in the window belongs to the abnormal data table information.
And if the target score is smaller than a preset score threshold value, determining the window as a non-target window.
It should be noted that the non-target window may be a window in which a similarity score between the character information in the window and the abnormal data table information, that is, a target score corresponding to the character information in the window, is smaller than a preset score threshold.
Specifically, if the target score corresponding to the character information in a certain window is smaller than a preset score threshold, the window is determined as a non-target window, that is, the character information in the window does not belong to the abnormal data table information.
Optionally, determining whether the data table to be detected is an abnormal data table according to the number of the target windows and a preset target window number threshold, including:
and if the number of the target windows is greater than or equal to the preset target window number threshold, determining the data table to be detected as an abnormal data table.
Specifically, if the number of the target windows with the target scores larger than or equal to the preset score threshold is larger than or equal to the preset target window number threshold, the data table to be detected is determined as an abnormal data table, that is, the data table to be detected may contain abnormal data.
And if the number of the target windows is smaller than the preset target window number threshold, determining the data table to be detected as a non-abnormal data table.
It should be understood that the non-exception data table may be a data table in which no exception data is contained in the table.
Specifically, if the number of the target windows with the target scores larger than or equal to the preset score threshold is smaller than the preset target window number threshold, the data table to be detected is determined to be a non-abnormal data table, that is, the data table to be detected may not contain abnormal data.
Optionally, the iteratively training the neural network model through the target sample set includes:
and establishing a neural network model.
Specifically, a neural network model corresponding to the machine learning model is established.
And inputting the abnormal character information and the character information samples in the target sample set into the neural network model to obtain the detection scores corresponding to the character information samples.
Specifically, the abnormal character information in the target sample set and all the character information samples are input into the neural network model, the similarity between each character information sample and the abnormal character information is identified, and a detection score corresponding to each character information sample, namely the similarity score between each character information sample and the abnormal character information is obtained.
And training parameters of the neural network model according to an objective function formed by the character information samples and the detection scores corresponding to the character information samples.
Specifically, an objective function is formed according to each character information sample and the detection score corresponding to each character information sample, and parameters of the neural network model are trained through the objective function.
And returning to execute the operation of inputting the abnormal character information and the character information samples in the target sample set into the neural network model to obtain the detection scores corresponding to the character information samples until the machine learning model is obtained.
Specifically, the operation of inputting the abnormal character information and the character information samples in the target sample set into the neural network model to obtain the detection scores corresponding to the character information samples is returned to execute, and the parameters of the neural network model are continuously trained until the machine learning model is obtained.
According to the technical scheme, the method comprises the steps of obtaining abnormal character information and table name information of a data table to be detected, wherein the table name information is composed of at least one character information, dividing the table name information according to preset window length and preset step length to obtain the character information in at least one window, inputting the abnormal character information and the character information in each window into a machine learning model to obtain a target score corresponding to the character information in each window, determining a target window according to the target score and a preset score threshold value, wherein the character information in the target window belongs to the abnormal data table information, obtaining the number of the target windows, and determining whether the data table to be detected is the abnormal data table or not according to the number of the target windows and the preset target window number threshold value. According to the technical scheme of the embodiment of the invention, the abnormal data table can be accurately and quickly found by dividing the table name information of the data table to be detected by using the sliding window algorithm, so that the abnormal data table is controlled, the problem of large potential safety hazard caused by incapability of finding newly added sensitive data tables in real time in the prior art is solved, the maintenance and the data safety guarantee are realized, the data safety early warning identification capability is improved, the potential safety hazard and the processing potential safety hazard are timely found, and the threat of the data safety risk is reduced.
Example two
Fig. 2 is a schematic structural diagram of an abnormal data table determination apparatus according to a second embodiment of the present invention. As shown in fig. 2, the apparatus includes: an acquisition module 201, a division module 202 and a determination module 203.
The obtaining module 201 is configured to obtain abnormal character information and table name information of a data table to be detected, where the table name information is composed of at least one character information;
the dividing module 202 is configured to divide the table name information according to a preset window length and a preset step length to obtain character information in at least one window;
the determining module 203 is configured to determine whether the data table to be detected is an abnormal data table according to the character information in each window and the abnormal character information.
Optionally, the determining module includes:
the input submodule is configured to input the abnormal character information and the character information in each window into a machine learning model, and obtain a target score corresponding to the character information in each window, where the machine learning model is obtained by iteratively training a neural network model through a target sample set, and the target sample includes: abnormal character information, character information samples and detection scores corresponding to the character information samples;
and the determining submodule is used for determining whether the data table to be detected is an abnormal data table or not according to the target score.
Optionally, the determining sub-module includes:
the first determining unit is used for determining a target window according to the target score and a preset score threshold value, wherein character information in the target window belongs to abnormal data table information;
the acquisition unit is used for acquiring the number of the target windows;
and the second determining unit is used for determining whether the data table to be detected is an abnormal data table or not according to the number of the target windows and a preset target window number threshold value.
Optionally, the first determining unit includes:
a first determining subunit, configured to determine the window as a target window if the target score is greater than or equal to the preset score threshold;
and the second determining subunit is configured to determine the window as a non-target window if the target score is smaller than the preset score threshold.
Optionally, the second determining unit includes:
a third determining subunit, configured to determine the data table to be detected as an abnormal data table if the number of the target windows is greater than or equal to the preset target window number threshold;
and the fourth determining subunit is configured to determine the data table to be detected as a non-abnormal data table if the number of the target windows is smaller than the preset target window number threshold.
Optionally, the input sub-module includes:
the establishing unit is used for establishing a neural network model;
the input unit is used for inputting the abnormal character information and the character information samples in the target sample set into the neural network model to obtain the detection scores corresponding to the character information samples;
the training unit is used for training the parameters of the neural network model according to an objective function formed by the character information samples and the detection scores corresponding to the character information samples;
and the operation unit is used for returning and executing the operation of inputting the abnormal character information and the character information samples in the target sample set into the neural network model to obtain the detection scores corresponding to the character information samples until a machine learning model is obtained.
The abnormal data table determining device provided by the embodiment of the invention can execute the abnormal data table determining method provided by any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the executing method.
EXAMPLE III
FIG. 3 shows a schematic block diagram of an electronic device 30 that may be used to implement an embodiment of the invention. Electronic devices are intended to represent various forms of digital computers, such as laptops, desktops, workstations, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device may also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions, are meant to be exemplary only, and are not meant to limit implementations of the inventions described and/or claimed herein.
As shown in fig. 3, the electronic device 30 includes at least one processor 31, and a memory communicatively connected to the at least one processor 31, such as a Read Only Memory (ROM) 32, a Random Access Memory (RAM) 33, and the like, wherein the memory stores a computer program executable by the at least one processor, and the processor 31 may perform various suitable actions and processes according to the computer program stored in the Read Only Memory (ROM) 32 or the computer program loaded from the storage unit 38 into the Random Access Memory (RAM) 33. In the RAM 33, various programs and data necessary for the operation of the electronic apparatus 30 can also be stored. The processor 31, the ROM 32, and the RAM 33 are connected to each other via a bus 34. An input/output (I/O) interface 35 is also connected to bus 34.
A plurality of components in the electronic device 30 are connected to the I/O interface 35, including: an input unit 36 such as a keyboard, a mouse, etc.; an output unit 37 such as various types of displays, speakers, and the like; a storage unit 38 such as a magnetic disk, optical disk, or the like; and a communication unit 39 such as a network card, modem, wireless communication transceiver, etc. The communication unit 39 allows the electronic device 30 to exchange information/data with other devices via a computer network such as the internet and/or various telecommunication networks.
The processor 31 may be a variety of general and/or special purpose processing components having processing and computing capabilities. Some examples of processor 31 include, but are not limited to, a Central Processing Unit (CPU), a Graphics Processing Unit (GPU), various specialized Artificial Intelligence (AI) computing chips, various processors running machine learning model algorithms, a Digital Signal Processor (DSP), and any suitable processor, controller, microcontroller, or the like. The processor 31 performs the various methods and processes described above, such as the exception data table determination method:
acquiring abnormal character information and table name information of a data table to be detected, wherein the table name information consists of at least one character information;
dividing the table name information according to a preset window length and a preset step length to obtain character information in at least one window;
and determining whether the data table to be detected is an abnormal data table or not according to the character information in each window and the abnormal character information.
In some embodiments, the anomaly data table determination method may be implemented as a computer program tangibly embodied on a computer-readable storage medium, such as storage unit 38. In some embodiments, part or all of the computer program may be loaded and/or installed onto the electronic device 30 via the ROM 32 and/or the communication unit 39. When the computer program is loaded into the RAM 33 and executed by the processor 31, one or more steps of the above described method of determining an abnormal data table may be performed. Alternatively, in other embodiments, the processor 31 may be configured to perform the exception table determination method by any other suitable means (e.g., by means of firmware).
Various implementations of the systems and techniques described here above may be implemented in digital electronic circuitry, integrated circuitry, field Programmable Gate Arrays (FPGAs), application Specific Integrated Circuits (ASICs), application Specific Standard Products (ASSPs), system on a chip (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and/or combinations thereof. These various embodiments may include: implemented in one or more computer programs that are executable and/or interpretable on a programmable system including at least one programmable processor, which may be special or general purpose, receiving data and instructions from, and transmitting data and instructions to, a storage system, at least one input device, and at least one output device.
A computer program for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus, such that the computer programs, when executed by the processor, cause the functions/acts specified in the flowchart and/or block diagram block or blocks to be performed. A computer program can execute entirely on a machine, partly on the machine, as a stand-alone software package, partly on the machine and partly on a remote machine or entirely on the remote machine or server.
In the context of the present invention, a computer-readable storage medium may be a tangible medium that can contain, or store a computer program for use by or in connection with an instruction execution system, apparatus, or device. A computer readable storage medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. Alternatively, the computer readable storage medium may be a machine readable signal medium. More specific examples of a machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.
To provide for interaction with a user, the systems and techniques described here can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to a user; and a keyboard and a pointing device (e.g., a mouse or a trackball) by which a user can provide input to the electronic device. Other kinds of devices may also be used to provide for interaction with a user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form, including acoustic, speech, or tactile input.
The systems and techniques described here can be implemented in a computing system that includes a back-end component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front-end component (e.g., a user computer having a graphical user interface or a web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such back-end, middleware, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: local Area Networks (LANs), wide Area Networks (WANs), blockchain networks, and the internet.
The computing system may include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. The server can be a cloud server, also called a cloud computing server or a cloud host, and is a host product in a cloud computing service system, so that the defects of high management difficulty and weak service expansibility in the traditional physical host and VPS service are overcome.
It should be understood that various forms of the flows shown above may be used, with steps reordered, added, or deleted. For example, the steps described in the present invention may be executed in parallel, sequentially, or in different orders, and are not limited herein as long as the desired results of the technical solution of the present invention can be achieved.
The above-described embodiments should not be construed as limiting the scope of the invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may be made in accordance with design requirements and other factors. Any modification, equivalent replacement, and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.
Claims (10)
1. An abnormal data table determination method, comprising:
acquiring abnormal character information and table name information of a data table to be detected, wherein the table name information consists of at least one character information;
dividing the table name information according to a preset window length and a preset step length to obtain character information in at least one window;
and determining whether the data table to be detected is an abnormal data table or not according to the character information in each window and the abnormal character information.
2. The method of claim 1, wherein determining whether the data table to be detected is an abnormal data table according to the character information and the abnormal character information in each window comprises:
inputting the abnormal character information and the character information in each window into a machine learning model to obtain a target score corresponding to the character information in each window, wherein the machine learning model is obtained by iteratively training a neural network model through a target sample set, and the target sample comprises: abnormal character information, character information samples and detection scores corresponding to the character information samples;
and determining whether the data table to be detected is an abnormal data table or not according to the target score.
3. The method of claim 2, wherein determining whether the data table to be tested is an abnormal data table according to the target score comprises:
determining a target window according to the target score and a preset score threshold, wherein character information in the target window belongs to abnormal data table information;
acquiring the number of target windows;
and determining whether the data table to be detected is an abnormal data table or not according to the number of the target windows and a preset target window number threshold.
4. The method of claim 3, wherein determining a target window based on the target score and a preset score threshold comprises:
if the target score is larger than or equal to the preset score threshold value, determining the window as a target window;
and if the target score is smaller than the preset score threshold value, determining the window as a non-target window.
5. The method according to claim 3, wherein determining whether the data table to be detected is an abnormal data table according to the number of the target windows and a preset target window number threshold comprises:
if the number of the target windows is larger than or equal to the preset target window number threshold, determining the data table to be detected as an abnormal data table;
and if the number of the target windows is smaller than the preset target window number threshold, determining the data table to be detected as a non-abnormal data table.
6. The method of claim 2, wherein iteratively training the neural network model through the set of target samples comprises:
establishing a neural network model;
inputting abnormal character information and character information samples in the target sample set into the neural network model to obtain detection scores corresponding to the character information samples;
training parameters of the neural network model according to an objective function formed by the character information samples and the detection scores corresponding to the character information samples;
and returning to execute the operation of inputting the abnormal character information and the character information samples in the target sample set into the neural network model to obtain the detection scores corresponding to the character information samples until a machine learning model is obtained.
7. An abnormal data table determination apparatus, comprising:
the system comprises an acquisition module, a storage module and a display module, wherein the acquisition module is used for acquiring abnormal character information and table name information of a data table to be detected, and the table name information consists of at least one character information;
the dividing module is used for dividing the table name information according to a preset window length and a preset step length to obtain character information in at least one window;
and the determining module is used for determining whether the data table to be detected is an abnormal data table according to the character information in each window and the abnormal character information.
8. The apparatus of claim 7, wherein the determining module comprises:
the input submodule is configured to input the abnormal character information and the character information in each window into a machine learning model, and obtain a target score corresponding to the character information in each window, where the machine learning model is obtained by iteratively training a neural network model through a target sample set, and the target sample includes: abnormal character information, character information samples and detection scores corresponding to the character information samples;
and the determining submodule is used for determining whether the data table to be detected is an abnormal data table or not according to the target score.
9. An electronic device, characterized in that the electronic device comprises:
at least one processor; and
a memory communicatively coupled to the at least one processor; wherein, the first and the second end of the pipe are connected with each other,
the memory stores a computer program executable by the at least one processor to enable the at least one processor to perform the method of determining an abnormal data table of any one of claims 1 to 6.
10. A computer-readable storage medium storing computer instructions for causing a processor to perform the method of determining an abnormal data table according to any one of claims 1 to 6 when executed.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211327239.0A CN115630068A (en) | 2022-10-27 | 2022-10-27 | Abnormal data table determining method, device, equipment and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211327239.0A CN115630068A (en) | 2022-10-27 | 2022-10-27 | Abnormal data table determining method, device, equipment and storage medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN115630068A true CN115630068A (en) | 2023-01-20 |
Family
ID=84906987
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202211327239.0A Pending CN115630068A (en) | 2022-10-27 | 2022-10-27 | Abnormal data table determining method, device, equipment and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN115630068A (en) |
-
2022
- 2022-10-27 CN CN202211327239.0A patent/CN115630068A/en active Pending
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN113792154A (en) | Method and device for determining fault association relationship, electronic equipment and storage medium | |
| CN113780098A (en) | Character recognition method, character recognition device, electronic equipment and storage medium | |
| CN114021156A (en) | Method, device and equipment for organizing vulnerability automatic aggregation and storage medium | |
| CN114363019A (en) | Method, device and equipment for training phishing website detection model and storage medium | |
| CN112699237B (en) | Label determination method, device and storage medium | |
| CN112148841B (en) | Object classification and classification model construction method and device | |
| CN113904943A (en) | Account detection method and device, electronic equipment and storage medium | |
| CN112784050A (en) | Method, device, equipment and medium for generating theme classification data set | |
| CN116755974A (en) | Cloud computing platform operation and maintenance method and device, electronic equipment and storage medium | |
| CN114722162B (en) | Feature type determination method and device, electronic equipment and storage medium | |
| US20230096921A1 (en) | Image recognition method and apparatus, electronic device and readable storage medium | |
| CN115630068A (en) | Abnormal data table determining method, device, equipment and storage medium | |
| CN114254650A (en) | Information processing method, device, equipment and medium | |
| CN115333783A (en) | API call abnormity detection method, device, equipment and storage medium | |
| CN114417029A (en) | Model training method and device, electronic equipment and storage medium | |
| CN113408280A (en) | Negative example construction method, device, equipment and storage medium | |
| CN116244740B (en) | Log desensitization method and device, electronic equipment and storage medium | |
| CN114330300A (en) | Penetration test document analysis method, device, equipment and storage medium | |
| CN114898374A (en) | Image semantic recognition method, device, equipment and storage medium | |
| CN117574168A (en) | Information report generation method and device | |
| CN115293157A (en) | Method and device for extracting Chinese text, electronic equipment and storage medium | |
| CN116680694A (en) | Malicious application detection method and device, electronic equipment and storage medium | |
| CN115952792A (en) | Text auditing method and device, electronic equipment, storage medium and product | |
| CN117076610A (en) | Identification method and device of data sensitive table, electronic equipment and storage medium | |
| CN117668294A (en) | Face library creation and video identification methods and devices and electronic equipment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |