WO2017016422A1

WO2017016422A1 - Cloud-based database detection method and device

Info

Publication number: WO2017016422A1
Application number: PCT/CN2016/090618
Authority: WO
Inventors: 王义成
Original assignee: 阿里巴巴集团控股有限公司
Priority date: 2015-07-29
Filing date: 2016-07-20
Publication date: 2017-02-02
Also published as: CN106407830B; CN106407830A

Abstract

The embodiments of the present application provide a cloud-based database detection method and device. The method comprises: determining a detection type of detection to be performed on one or more database embodiments, wherein the detection type comprises performance detection and/or safety detection; adapting, according to the detection type, a priority order of the one or more database embodiments; performing, according to the adapted priority order, the performance detection and/or safety detection on the one or more database embodiments, and obtaining a result of the performance detection and/or a result of safety detection; when the result of the performance detection and/or the result of safety detection match a predefined performance problem and/or a predefined safety problem, generating auxiliary database processing information; and transmitting the result of the performance detection and/or the result of safety detection, and the auxiliary database processing information. The embodiments of the present application implement an active cloud database management service, significantly reducing any hidden problem of the cloud database embodiments in performance and safety aspects.

Description

Method and device for detecting cloud-based database

The present application claims priority to Chinese Patent Application Serial No. No. No. No. No. No. No. No. No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No

Technical field

The present application relates to the technical field of computer processing, and in particular, to a cloud-based database detection method and a cloud-based database detection apparatus.

Background technique

As the scale of cloud computing grows larger, various cloud-based products, such as virtual hosts and cloud databases, enter people's lives, learning, and work.

Due to the superiority of the cloud, a large number of users choose to deploy the computer architecture in the cloud, and the data will select the cloud database for storage.

The technical threshold of operation and optimization of cloud database is high, and users have incomplete knowledge of database. As a result, many users do not have the ability to maintain and maintain a good database, which makes cloud database instances have different levels of hidden dangers in terms of performance and security.

In terms of performance, due to poor operation and maintenance and optimization, the performance of cloud database performance is very low, and even affects its own business processing.

In terms of security, due to poor operation and maintenance and optimization, there are loopholes in monitoring, which are easily stolen by criminals.

Summary of the invention

In view of the above problems, embodiments of the present application have been made in order to provide a cloud-based database detection method and a corresponding cloud-based database detection apparatus that overcome the above problems or at least partially solve the above problems.

In order to solve the above problem, the embodiment of the present application discloses a method for detecting a database in a cloud, including:

Determining a type of detection for detecting one or more database instances; the type of detection includes performance detection and/or security detection;

Adjusting a priority of the one or more database instances according to the detection type;

Performing performance detection and/or security detection on the one or more database instances according to the adjusted priority, obtaining performance detection results and/or security detection results;

Generating database processing prompt information when the performance detection result and/or the security detection result matches a preset performance problem and/or a security problem;

Pushing the performance test result and/or the security test result and the database processing prompt information.

Preferably, the step of adjusting the priority of the one or more database instances according to the detection type comprises:

When the detection type is performance detection, increase the priority of the database instance that meets the preset low performance condition;

and / or,

When the detection type is performance detection, increasing the priority of the database instance whose calling frequency is higher than the preset frequency threshold;

and / or,

When the detection type is security detection, increase the priority of the database instance whose creation time is less than the preset time threshold;

and / or,

When the detection type is security detection, the priority of the database instance whose priority is lower than the preset priority threshold is raised.

Preferably, the step of performing performance detection and/or security detection on the one or more database instances according to the adjusted priority, and obtaining the performance detection result and/or the security detection result includes:

Determining the performance status of the one or more database instances according to the adjusted priority;

When the performance state meets a preset low performance condition, performing performance detection on the database instance to obtain a performance detection result.

Preferably, the step of determining the performance status of the one or more database instances according to the adjusted priority includes:

Determining, according to the adjusted priority, at least one of a CPU usage, an I/O read/write frequency, a connection number, and a disk space usage rate of the one or more database instances;

Wherein, the performance state satisfies a preset low performance condition when at least one of the following conditions is met:

The CPU utilization is higher than a preset utilization threshold, the I/O read/write frequency is higher than a preset read/write frequency threshold, the connection number is greater than a preset connection number threshold, and the disk space usage rate is Greater than the preset usage threshold value.

Preferably, the step of performing performance detection on the database instance, and obtaining the performance detection result includes:

Performing performance detection on at least one attribute of the configuration, table structure, SQL statement, and architecture of the database instance, and obtaining at least one performance detection of configuration detection result, table structure detection result, SQL statement detection result, and architecture detection result result.

Preferably, when the performance detection result and/or the security detection result match the preset performance problem and/or the security problem, the step of generating the database processing prompt information includes:

When the configuration detection result matches the preset low configuration condition, generating database processing prompt information of the elevated configuration;

and / or,

When the table structure detection result matches the preset unreasonable structural condition, generating database processing prompt information of the adjustment table structure;

and / or,

When the SQL statement detection result matches the preset problem statement condition, generating database processing prompt information for modifying the SQL statement;

and / or,

When the architecture detection result matches the preset problem architecture condition, the database processing prompt information of the adjustment architecture is generated.

Grab the data packets sent to the one or more database instances according to the adjusted priority;

Performing at least one type of security detection in the password cracking, SQL injection, and whitelisting on the data packet, and obtaining at least one of the password crack detection result, the SQL injection detection result, and the whitelist detection result.

When the password crack detection result indicates that the password cracking behavior occurs, generating database processing prompt information of at least one of the attack source, the whitelist adjustment, and the adjustment password;

and / or,

When the SQL injection detection result indicates that the SQL injection behavior occurs, generating a current SQL statement and checking database processing prompt information of at least one of the application programs;

and / or,

When the whitelist result matches the preset large-range condition, the database processing prompt information for modifying the whitelist is generated.

The embodiment of the present application further discloses a cloud-based database detecting apparatus, including:

a detection type determining module, configured to determine a type of detection for detecting one or more database instances; the type of detection includes performance detection and/or security detection;

a priority adjustment module, configured to adjust a priority of the one or more database instances according to the detection type;

a detecting module, configured to perform performance detection and/or security detection on the one or more database instances according to the adjusted priority, and obtain performance testing results and/or security testing results;

a prompt information generating module, configured to generate database processing prompt information when the performance detection result and/or the security detection result match a preset performance problem and/or a security problem;

The pushing module is configured to push the performance detection result and/or the security detection result and the database processing prompt information.

Preferably, the priority adjustment module includes:

a first improvement submodule, configured to increase a priority of a database instance that meets a preset low performance condition when the detection type is performance detection;

and / or,

a second improvement submodule, configured to: when the detection type is performance detection, increase a priority of a database instance whose calling frequency is higher than a preset frequency threshold;

and / or,

The third improvement sub-module is configured to: when the detection type is security detection, increase the priority of the database instance whose creation time is less than a preset time threshold;

and / or,

The fourth improvement submodule is configured to: when the detection type is security detection, increase the priority of the database instance whose priority is lower than the preset priority threshold.

Preferably, the detecting module comprises:

a performance status determining submodule, configured to determine a performance status of the one or more database instances according to the adjusted priority;

The performance detection sub-module is configured to perform performance detection on the database instance when the performance state meets a preset low performance condition, and obtain a performance detection result.

Preferably, the performance status determination submodule includes:

a performance determining unit, configured to determine, according to the adjusted priority, at least one of a CPU usage, an I/O read/write frequency, a connection quantity, and a disk space usage rate of the one or more database instances;

The CPU utilization is higher than a preset utilization threshold, the I/O read/write frequency is higher than a preset read/write frequency threshold, the connection number is greater than a preset connection number threshold, and the disk space usage rate is Greater than the preset usage threshold.

Preferably, the performance detection submodule comprises:

The database instance attribute detecting unit is configured to perform performance detection on the configuration, the table structure, the SQL statement, and at least one attribute of the database instance, obtain configuration detection result, table structure detection result, SQL statement detection result, and architecture detection. At least one of the results of the performance test.

Preferably, the prompt information generating module includes:

a first generation submodule, configured to generate database processing prompt information of the elevated configuration when the configuration detection result matches the preset low configuration condition;

and / or,

a second generation submodule, configured to generate database processing prompt information of the adjustment table structure when the table structure detection result matches the preset unreasonable structural condition;

and / or,

a third generation submodule, configured to generate a database processing prompt information for modifying the SQL statement when the SQL statement detection result matches a preset problem statement condition;

and / or,

And a fourth generation submodule, configured to generate database processing prompt information of the adjustment architecture when the architecture detection result matches the preset problem architecture condition.

Preferably, the detecting module comprises:

The packet capture sub-module is configured to capture data packets sent to the one or more database instances according to the adjusted priority;

The security detection sub-module is configured to perform at least one type of security detection, password injection detection, SQL injection detection result, and white list detection result for password cracking, SQL injection, and whitelist detection of the data packet. Test results.

Preferably, the prompt information generating module includes:

a fifth generation submodule, configured to generate, when the password crack detection result indicates that a password cracking behavior occurs, generating database processing prompt information of at least one of an attack source, a whitelist adjustment, and an adjustment password;

and / or,

a sixth generation submodule, configured to: when the SQL injection detection result indicates that the SQL injection behavior occurs, generate a current SQL statement, and check database processing prompt information of at least one of the application programs;

and / or,

The seventh generation sub-module is configured to generate database processing prompt information for modifying the whitelist when the whitelist result matches the preset large-range condition.

Embodiments of the present application include the following advantages:

The embodiment of the present application adjusts the priority of the database instance according to the detection type, and according to the priority of the priority database instance, if a performance problem or a security problem occurs, the database instance processing prompt information is generated and pushed, and the cloud database steward of the active operation and maintenance is realized. The service greatly reduces the technical threshold of the operation and optimization of the cloud database, greatly reduces the hidden dangers of the performance and security of the cloud database instance. On the one hand, it improves the operation efficiency of the cloud database and ensures the business processing. Reduce the vulnerability of monitoring and ensure the security of data in the cloud database.

DRAWINGS

1 is a flow chart of steps of an embodiment of a method for detecting a cloud-based database according to the present application;

2 is a structural block diagram of an embodiment of a detection apparatus for a cloud-based database of the present application.

detailed description

The above described objects, features and advantages of the present application will become more apparent and understood.

Referring to FIG. 1 , a flow chart of steps of a method for detecting a cloud-based database of the present application is shown, which may specifically include the following steps:

Step 101: Determine a type of detection for detecting one or more database instances;

It should be noted that the embodiments of the present application can be applied to cloud platforms.

A cloud platform is a kind of computer cluster that uses cloud computing, such as a distributed system, and provides cloud computing services, such as ECS (Elastic Compute Service), RDS (Relational Database). Service, relational database service) database, OSS (Open Storage Service) storage, and so on.

Usually, a database is a logical concept, and corresponding to the actual physical concept, can refer to one or a bunch of files on the disk, which contains data.

The database referred to in the embodiment of the present application may be a cloud database, such as a relational database instance or the like.

Database instances are database programs that are running in computer memory, and some memory space allocated for these programs. The instance is responsible for implementing various functions such as providing network connections to users, reading and writing data files, and so on.

Taking the RDS database as an example of a cloud database, the RDS database provides a database instance running directly on the physical server to the user, and can support MySQL, SQL (Structured Query Language) Server, and PostgreSQL. Database access protocol

At present, the database code, application and tools can also be applied to the RDS database, and the user can operate the RDS database in the cloud platform through a client such as a browser to reduce the redevelopment cost.

The RDS database in the cloud platform takes on time-consuming and labor-intensive database management tasks, enabling users to concentrate on application development and business development.

Since the technical thresholds for the operation and optimization of the cloud database such as the relational database are high, and the general user does not have the corresponding professional knowledge, the embodiment of the present application proposes a cloud database steward service of active operation and maintenance, actively taking the cloud. The database instance performs detection of dimensions such as performance and security, that is, the detection type may include performance detection and/or security detection.

Step 102: Adjust a priority of the one or more database instances according to the detection type.

In practical applications, the number of cloud database instances in the cloud platform is very large, and all cloud database instances cannot be detected at one time. Therefore, the priority of the database instance can be adjusted in the following manner:

1. When the detection type is performance detection, increase the priority of the database instance that meets the preset low performance condition;

In this manner, low performance conditions that characterize the performance of the database instance can be set in advance, for example, high CPU utilization, high I/O read/write frequency, high number of connections, high disk space usage, and the like.

If the cloud database instance is often satisfied (for example, the frequency of the frequency is higher than a certain frequency threshold for a period of time), the low performance condition indicates that the cloud database instance may have a performance bottleneck, and the priority may be increased to perform performance detection first.

2. When the detection type is performance detection, increase the priority of the database instance whose calling frequency is higher than the preset frequency threshold;

In this mode, if the user invokes a cloud database instance, such as opening a management page of the cloud database, in the cloud database In the case of reading and writing operations, etc., the calling frequency can be recorded.

If the frequency of the cloud database instance is higher than the preset frequency threshold, indicating that the cloud database instance is used frequently, the priority can be increased to prioritize performance detection.

3. When the detection type is security detection, increase the priority of the database instance whose creation time is less than the preset time threshold;

In this mode, if the creation time of the cloud database instance is less than the preset time threshold, it indicates that the creation time of the cloud database instance is short, and the security performance of the newly created cloud database instance is generally not optimized to the optimal state. , you can increase its priority to prioritize security detection.

4. When the detection type is security detection, increase the priority of the database instance whose priority is lower than the preset priority threshold.

In this mode, if the priority of the cloud database instance is lower than the preset priority threshold, indicating that the cloud database instance has a lower priority, that is, an object that is not preferentially detected, the priority may be raised in time to prevent being hungry. Dead (that is, no safety test has been performed for a long time).

Certainly, the manner of adjusting the priority is only used as an example. In the implementation of the embodiment of the present application, other manners of adjusting the priority may be set according to the actual situation, which is not limited by the embodiment of the present application. In addition, in addition to the above-mentioned manner of adjusting priorities, those skilled in the art may also adopt other manners of adjusting priorities according to actual needs, and the embodiment of the present application does not limit this.

Step 103: Perform performance detection and/or security detection on the one or more database instances according to the adjusted priority, and obtain performance test results and/or security test results.

The detection of different detection types has a corresponding priority. The higher the priority of the detection type, the more preferential the detection of the detection type.

For example, the higher the priority of performance detection, the higher the performance detection;

For example, the higher the priority of security detection, the higher the priority is to perform security detection.

Of course, for the same cloud database instance, the performance detection may be performed separately, or the security detection may be performed separately, and the performance detection and the security detection may be performed at the same time, which is not limited in the embodiment of the present application.

In a preferred embodiment of the present application, step 103 may include the following sub-steps:

Sub-step S11, determining the performance status of the one or more database instances according to the adjusted priority;

Sub-step S12, when the performance state meets a preset low performance condition, performing performance detection on the database instance to obtain a performance detection result.

In the embodiment of the present application, the performance of the cloud database instance may be periodically determined to identify the cloud database. The performance status of the example.

If the performance status of the cloud database instance meets the preset low performance condition, it indicates that the performance of the cloud database instance is low, and the performance is abnormal, and performance detection can be performed.

Further, the embodiment of the present application can determine the CPU (Central Processing Unit) utilization, I/O (Input/Output, input/output port) reading of one or more database instances according to the adjusted priority. At least one of the write frequency, the number of connections, and the disk space usage.

In practical applications, the cloud database is faced with multiple users on the physical machine, and the cloud platform can be allocated to multiple users in a physically isolated manner.

Since multiple cloud database instances share the resources of one physical machine, the cloud platform can allocate corresponding CPU resources, IOPS (that is, the number of read/write (I/O) operations per second), the number of connections, and the number of connections, for the configuration of the cloud database instance. Disk space and more.

After the user allocates a cloud database instance, a unique instance ID can be generated. When the performance check is initiated, the CPU ID, I/O read/write frequency, connection number, disk space usage, etc. can be detected according to the instance ID. Wait.

For CPU utilization, the ratio of CPU resources currently consumed by the cloud database instance to the allocated CPU resources.

If, for a cloud database instance with 240M memory (configuration), the cloud platform can allocate 10% of the CPU resources of the physical machine to the cloud database instance. If the cloud database instance uses 5% of the CPU resources of the physical machine, this time The CPU utilization of this cloud database instance is 50%.

For I/O read/write frequency, it refers to the I/O read/write frequency allocated by the cloud database instance to this physical machine, which can be characterized by IOPS.

Further, a cloud database instance of the user is a process on the physical machine, and the process can be isolated by using the cgroup, and the IOPS used by the cloud database instance can be clearly displayed through the cgroup.

For the number of connections, the number of connections between the cloud database instance and the client (application, command line tools, etc.).

The cloud database instance can have parameter connections for managing the number of connections. By querying the connection, the number of connections can be clearly indicated.

For disk space usage, the ratio of the disk space currently used by the cloud database instance to the allocated disk space.

If, for a cloud database instance with 240M memory (configuration), the cloud platform can be assigned to this cloud data. The library instance has 10 GB of disk space of the physical machine. If the cloud database instance uses the disk space of the physical machine 3G, the disk space utilization rate of the cloud database instance is 30%.

Wherein, when at least one of the following conditions is met, the performance state satisfies a preset low performance condition:

1. The CPU utilization is higher than the preset utilization threshold;

In a specific implementation, the user or the technician of the cloud platform may set a corresponding utilization threshold according to the configuration of the cloud database instance.

If the CPU utilization is higher than the preset utilization threshold, such as 80%, it can indicate that the CPU utilization is higher.

A high CPU utilization may cause the execution of SQL statements sent to the cloud database instance to be slow, resulting in a decrease in the performance of the cloud database instance.

2. The I/O read/write frequency is higher than the preset read/write frequency threshold;

In a specific implementation, the user or the technician of the cloud platform can set the corresponding read/write frequency threshold according to the configuration of the cloud database instance.

If the I/O read/write frequency (such as IOPS) is higher than the preset read/write frequency threshold, it can indicate that the I/O read/write frequency is high.

For example, for a cloud database instance with 240M memory (configuration), the cloud platform can allocate 150 IOPS. If the IOPS of the cloud database instance is 140, the IOPS usage rate exceeds the read/write frequency threshold of 80%, which can be considered as a higher read/write frequency. .

In the case of high I/O read/write frequencies (such as IOPS), it is easy to cause performance degradation of cloud database instances.

For example, some SQL queries require access to old data (data is on disk), which can be very slow.

3. The number of connections is greater than a preset number of connections threshold;

In a specific implementation, the user or the technician of the cloud platform may set a corresponding connection quantity threshold according to the configuration of the cloud database instance.

It should be noted that the connection number threshold may be a numerical value representation or a connection rate representation.

When the number of connections threshold is a numeric value, the number of connections can be directly compared to the number of connections threshold.

When the number of connections threshold is the connection rate, you can convert the number of connections to the connection rate (that is, the number of connections used / the number of configured connections), and then compare with the number of connections threshold, or you can convert the number of connections threshold to the number of connections ( That is, the number of configured connections * the number of connections threshold) is compared with the number of connections.

If the number of connections is greater than the preset number of connections threshold, it can indicate that the number of connections is high.

A high number of connections can prompt the user to pay attention to the use of the application. It may be because the unreasonable SQL statement takes too long to execute, and the connection is not released.

In addition, a high number of connections will consume too much memory, so that too little data is carried in the memory, which affects the response time of the cloud database instance.

If the number of connections is full (that is, the maximum number of connections reached the configuration), new connections will not be allowed and the user's business will be stopped.

4. The disk space usage is greater than the preset usage threshold.

In a specific implementation, the user or the technician of the cloud platform can set the corresponding usage threshold according to the configuration of the cloud database instance.

If the disk space usage is greater than the preset usage threshold, it can indicate that the disk space is occupied.

The disk usage is too large, usually because the data file is too large, the log file is too large, and the temporary file is too large. Among them, most of the temporary files are unreasonable SQL statement query and disk space operation. This situation can seriously affect database instance performance.

Of course, the foregoing performance state is only an example. When the embodiment of the present application is implemented, other performance states may be set according to actual conditions, which is not limited by the embodiment of the present application. In addition, other performance states may be used by those skilled in the art in addition to the above-mentioned performance states, and the embodiments of the present application do not limit this.

In addition, the embodiment of the present application may perform performance detection on at least one attribute of a database instance configuration, a table structure, a SQL statement, and an architecture, and obtain configuration detection results, table structure detection results, SQL statement detection results, and architecture detection results. At least one performance test result.

Specifically, the configuration refers to the model of the cloud database, which reflects the allocated hardware resources and can affect the performance of the cloud database instance. Examples can be as follows:

型号model	连接数量Number of connections	IOPSIOPS	磁盘空间disk space
240M240M	6060	150150	10G10G
600M600M	150150	300300	20G20G
1200M1200M	300300	600600	50G50G

If the configuration is tested for performance, the configuration test results can be obtained.

A database may contain several data tables. The table in the table structure of the embodiment of the present application refers to a data table in the cloud database, which is a logical structure for storing and operating data, for example, a table a, inside Contains three fields, log1, log2, log3.

Whether the table structure is reasonable or not affects the execution of the SQL statement, thereby affecting the performance of the cloud database instance.

If the performance of the table structure is tested, the table structure test result can be obtained.

The SQL statement is a set of operation commands of the database. It can query, update (such as insert, delete, modify) and control the data in the cloud database, directly reflecting the performance of the cloud database instance.

If the performance of the SQL statement is tested, the SQL statement detection result can be obtained.

The architecture refers to the application architecture of the database. Whether the architecture has problems affects the performance of the cloud database instance.

For example, if the database instance has more read operations and fewer write operations, a read-only instance can be used to provide a main multi-read architecture;

For another example, if the database instance has a lot of write operations, you can use a horizontally split architecture to extend the write capability.

Of course, the foregoing performance detection is only an example. When the embodiment of the present application is implemented, other performance detections may be set according to actual conditions, which is not limited by the embodiment of the present application. In addition, in addition to the foregoing performance detection, other performance detections may be used by those skilled in the art according to actual needs, and the embodiment of the present application does not limit this.

In another preferred embodiment of the present application, step 103 may include the following sub-steps:

Sub-step S21, grabbing the data packet sent to the one or more database instances according to the adjusted priority;

Sub-step S22, performing at least one type of security detection in the password cracking, SQL injection, and whitelist on the data packet, and obtaining at least one of the password crack detection result, the SQL injection detection result, and the whitelist detection result.

In the embodiment of the present application, the security dimension of the cloud database instance may be checked. Generally, the database instance is used to capture the packet, and the protocol analysis is performed to check whether the statement sent to the database instance has a password cracking or a SQL injection attack.

Specifically, the password in the password cracking in the embodiment of the present application refers to the login password of the cloud database, which can be set by the user to which the cloud database belongs, and the criminals may perform brute force cracking by means of exhaustion.

If the security detection of the password cracking is performed, the password crack detection result can be obtained.

SQL injection refers to inserting SQL commands into a web form to submit or input a query string for a domain name or page request, and finally spoofing the server to execute malicious SQL commands.

That is, SQL is the ability to inject malicious SQL statements into the back-end database engine using existing applications. It can get a database on a website with security vulnerabilities by entering malicious SQL statements in a web form instead of following The designer intends to execute the SQL statement.

If the security injection of SQL injection is performed, the SQL injection detection result can be obtained.

The whitelist refers to a trusted list (such as an IP address), and the cloud database can only accept access from the whitelist and reject access outside the whitelist.

If the whitelist security test is performed, the whitelist detection result can be obtained.

Step 104: Generate database processing prompt information when the performance detection result and/or the security detection result match a preset performance problem and/or a security problem;

If the performance check result matches the preset performance problem, it indicates that the current cloud database instance may have the same performance problem. You can generate corresponding database processing prompt information. It is recommended to process the database to improve performance.

If the security detection result matches the preset security problem, it indicates that the current cloud database instance may have the same security problem, and the corresponding database processing prompt information may be generated. It is recommended to process the database to improve security.

In a specific implementation, for the performance detection, the database processing prompt information may be generated by one or more of the following methods:

1. When the configuration detection result matches the preset low configuration condition, generating database processing prompt information of the upgrade configuration;

If the current CPU utilization, number of connections, IOPS, etc. are higher (for example, greater than 80%), and the database table structure is also reasonable (such as index, storage engine and other information are no problem), it is possible that the model of the cloud database If the hardware resource is too low, it is judged to match the low configuration condition.

If the configuration detection result matches the preset low configuration condition, the current cloud database configuration may be low, which may result in high CPU utilization, multiple connections, high IOPS, and slow execution of SQL statements.

It should be noted that the low configuration condition is a relative condition, which is for the current service, such as the configuration of the cloud database of 240M memory, and the web access service may be a low configuration, but may be for the storage log service. It is a high configuration.

For the current cloud database that cannot meet the user's business needs, you can recommend upgrading the configuration (database processing prompt information).

Further, the recommended reasonable configuration can be given according to the current usage of the cloud database (such as CPU usage, IOPS, number of connections, disk space, etc.).

2. When the detection result of the table structure matches the preset unreasonable structural condition, generating database processing prompt information of the adjustment table structure;

If the IOPS is high and the query has a large number of slow queries, then it can be judged that the unreasonable structural conditions are matched.

If the table structure detection result matches the preset unreasonable structural condition, it may indicate that the current cloud database data packet structure is unreasonable, and in most cases, the IOPS may be high, and sometimes the number of connections may be high, and the CPU utilization rate is high. Thereby affecting the performance of the cloud database instance.

For unreasonable table structure, you can suggest to adjust (such as modify, increase) the table structure (database processing prompt information).

For example, for slow queries, an index can be created to eliminate slow queries and greatly reduce IOPS.

3. When the SQL statement detection result matches the preset problem statement condition, generating a database instance processing prompt information for modifying the SQL statement;

If the currently executed SQL statement is a slow query, it can be judged to match the problem statement condition.

If the SQL statement detection result matches the preset problem statement condition, it can indicate that the SQL statement has a problem. In most cases, the IOPS may be high, and sometimes the connection number is high and the CPU usage is high, thereby affecting the performance of the cloud database instance. .

For problematic SQL statements, you can suggest modifying the SQL statement (database processing prompt information).

For example, if the query performance of the SQL statement is too slow, the analysis is because the implicit conversion does not match the index, and the user can be prompted to modify the calling mode of the SQL statement.

4. When the architecture detection result matches the preset problem architecture condition, the database processing prompt information of the adjustment architecture is generated.

According to the scenario of the user SQL statement, it is judged that there are many read operations, fewer write operations, or the write operation bottleneck is serious, and if the configuration cannot be upgraded, the matching problem architecture condition can be judged.

If the architecture detection result matches the preset problem architecture condition, it may indicate that the current cloud database architecture has a problem, which may cause a bottleneck in the performance of the database instance, and does not support its own service well.

For the problematic architecture, you can suggest modifying the database schema (database processing hints).

For example, in a scenario where there are many read operations and fewer write operations, the user is prompted to apply a read-only instance.

For another example, in a scenario where a write operation has a bottleneck, it is recommended to use a distributed database.

In addition, for security detection, database processing prompt information can be generated by one or more of the following methods:

1. When the password crack detection result indicates that the password cracking behavior occurs, generating database processing prompt information of at least one of the attack source, adjusting the whitelist, and adjusting the password;

If there is a case where a certain IP address is consecutive N (N is a positive integer that can be adjusted by the user), the password cracking behavior can be considered.

For the password cracking behavior, the corresponding database processing prompt information can be generated to prompt the user to attack from which IP address, or, it is recommended to adjust the whitelist, refuse access from the IP address, or prompt to adjust the password to increase the strength of the password to prevent brute force.

2. When the SQL injection detection result indicates that the SQL injection behavior occurs, generating a current SQL statement and checking database processing prompt information of at least one of the application programs;

If the SQL statement matches some commonly used injection statements, then SQL injection behavior can be considered.

For example, the name of the table is usually admin, adminuser, user, pass, password, etc., and the SQL statement such as and 0<>(select count(*)from%) (% is the name of the table) can be used to guess the table.

For the SQL injection behavior, you can generate the corresponding database processing prompt information, prompting the user what SQL statement is currently injecting behavior. It is recommended that the user check their application to confirm whether SQL injection occurs, and let the user modify the application.

3. When the whitelist result matches the preset large-range condition, generate database modification prompt information for modifying the whitelist.

If the whitelist is set to % (that is, all IP addresses are allowed to be accessed), it can be judged that the matching of a wide range of conditions matches.

If the whitelist result matches the preset large-range condition, the whitelist range may be considered too large. Further, it may be suggested to modify the whitelist and jump to the whitelist modification page for modification.

Of course, the foregoing database processing prompt information is only an example. When the embodiment of the present application is implemented, other database processing prompt information may be set according to actual conditions, which is not limited in the embodiment of the present application. In addition, in addition to the foregoing database processing prompt information, those skilled in the art may also use other databases to process the prompt information according to actual needs, which is not limited in the embodiment of the present application.

It should be noted that the foregoing performance problems, security problems, low performance conditions, low configuration conditions, unreasonable structural conditions, problem statement conditions, problem architecture conditions, large-scale conditions, and the like may be set by a person skilled in the art according to actual conditions. The application embodiment does not limit this.

Step 105: Push the performance detection result and/or the security detection result and the database processing prompt information.

After the performance detection and security detection are completed, the corresponding performance detection result, security detection result, and database processing prompt information can be pushed to the user according to a preset pushing manner (such as mail, short message, cloud platform control interface, etc.) to realize active discovery. The problem is active operation and maintenance.

In the embodiment of the present application, the priority of the database instance is adjusted according to the detection type, and according to the priority of the priority database instance, if a performance problem or a security problem occurs, the database instance processing prompt information is generated and pushed, and the active operation and maintenance cloud database is realized. The butler service greatly reduces the technical threshold for the operation and optimization of the cloud database, greatly reduces the hidden dangers of the performance and security of the cloud database instance. On the one hand, it improves the operational efficiency of the cloud database. Rate, guarantee business processing, on the other hand, reduce monitoring vulnerabilities and ensure data security in the cloud database.

Of course, in addition to the active operation and maintenance of the cloud platform, the user can actively request performance detection and/or security detection in the control interface of the cloud database, and the cloud platform responds to the request, performs performance detection and/or security detection on the database, and obtains Performance test results and/or safety test results; generate database processing prompt information when performance test results and/or safety test results match preset performance problems and/or security issues; and, in cloud database control The interface displays performance test results and/or security test results and database processing prompt information.

It should be noted that, for the method embodiments, for the sake of simple description, they are all expressed as a series of action combinations, but those skilled in the art should understand that the embodiments of the present application are not limited by the described action sequence, because In accordance with embodiments of the present application, certain steps may be performed in other sequences or concurrently. In the following, those skilled in the art should also understand that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required in the embodiments of the present application.

Referring to FIG. 2, a structural block diagram of an embodiment of a detection apparatus for a cloud-based database of the present application is shown, which may specifically include the following modules:

a detection type determining module 201, configured to determine a detection type for detecting one or more database instances; the detection type includes performance detection and/or security detection;

The priority adjustment module 202 is configured to adjust a priority of the one or more database instances according to the detection type;

The detecting module 203 is configured to perform performance detection and/or security detection on the one or more database instances according to the adjusted priority, to obtain a performance detection result and/or a security detection result;

The prompt information generating module 204 is configured to generate database processing prompt information when the performance detection result and/or the security detection result match a preset performance problem and/or a security problem;

The pushing module 205 is configured to push the performance detection result and/or the security detection result and the database processing prompt information.

In a preferred embodiment of the present application, the priority adjustment module 202 may include the following submodules:

and / or,

a second improvement submodule, configured to increase a calling frequency higher than a preset frequency threshold when the detection type is performance detection The priority of the database instance of the value;

and / or,

In a preferred embodiment of the present application, the detecting module 203 may include the following submodules:

In a preferred example of the embodiment of the present application, the performance status determining submodule may include the following units:

In a preferred example of the embodiment of the present application, the performance detecting submodule may include the following units:

In a preferred example of the embodiment of the present application, the prompt information generating module 204 may include the following sub-modules:

and / or,

For the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiment.

The various embodiments in the present specification are described in a progressive manner, and each embodiment focuses on differences from other embodiments, and the same similar parts between the various embodiments can be referred to each other.

Those skilled in the art will appreciate that embodiments of the embodiments of the present application can be provided as a method, apparatus, or computer program product. Therefore, embodiments of the present application may adopt an entirely hardware embodiment, an entirely software embodiment, or a combination of soft A form of embodiment of hardware and hardware. Moreover, embodiments of the present application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.

In a typical configuration, the computer device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory. The memory may include non-persistent memory, random access memory (RAM), and/or non-volatile memory in a computer readable medium, such as read only memory (ROM) or flash memory. Memory is an example of a computer readable medium. Computer readable media includes both permanent and non-persistent, removable and non-removable media. Information storage can be implemented by any method or technology. The information can be computer readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory. (ROM), electrically erasable programmable read only memory (EEPROM), flash memory or other memory technology, compact disk read only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, Magnetic tape cartridges, magnetic tape storage or other magnetic storage devices or any other non-transportable media can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include non-persistent computer readable media, such as modulated data signals and carrier waves.

Embodiments of the present application are described with reference to flowcharts and/or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of the present application. It will be understood that each flow and/or block of the flowchart illustrations and/or FIG. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor or other programmable data processing terminal device to produce a machine such that instructions are executed by a processor of a computer or other programmable data processing terminal device Means are provided for implementing the functions specified in one or more of the flow or in one or more blocks of the flow chart.

The computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device. The instruction device implements the functions specified in one or more blocks of the flowchart or in a flow or block of the flowchart.

These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device such that a series of operational steps are performed on the computer or other programmable terminal device to produce computer-implemented processing, such that the computer or other programmable terminal device The instructions executed above provide steps for implementing the functions specified in one or more blocks of the flowchart or in a block or blocks of the flowchart.

While a preferred embodiment of the embodiments of the present application has been described, those skilled in the art can make further changes and modifications to the embodiments once they are aware of the basic inventive concept. Therefore, the appended claims are intended to be interpreted as including all the modifications and the modifications

Finally, it should also be noted that in this context, relational terms such as first and second are used merely to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply these entities. There is any such actual relationship or order between operations. Furthermore, the terms "comprises" or "comprising" or "comprising" or any other variations are intended to encompass a non-exclusive inclusion, such that a process, method, article, or terminal device that includes a plurality of elements includes not only those elements but also Other elements that are included, or include elements inherent to such a process, method, article, or terminal device. An element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or terminal device that comprises the element, without further limitation.

The above is a detailed description of a cloud-based database detection method and a cloud-based database detection device provided by the present application. The principle and implementation manner of the present application are described in the following. The description of the embodiments is only for helping to understand the method of the present application and its core ideas; at the same time, for those of ordinary skill in the art, according to the idea of the present application, there will be changes in specific embodiments and application scopes. The above description should not be taken as limiting the present application.

Claims

A cloud-based database detection method, comprising:

Determining a type of detection for detecting one or more database instances; the type of detection includes performance detection and/or security detection;

Adjusting a priority of the one or more database instances according to the detection type;

Performing performance detection and/or security detection on the one or more database instances according to the adjusted priority, obtaining performance detection results and/or security detection results;

Generating database processing prompt information when the performance detection result and/or the security detection result matches a preset performance problem and/or a security problem;

Pushing the performance test result and/or the security test result and the database processing prompt information.
The method according to claim 1, wherein the step of adjusting the priority of the one or more database instances according to the detection type comprises:

When the detection type is performance detection, increase the priority of the database instance that meets the preset low performance condition;

and / or,

When the detection type is performance detection, increasing the priority of the database instance whose calling frequency is higher than the preset frequency threshold;

and / or,

When the detection type is security detection, increase the priority of the database instance whose creation time is less than the preset time threshold;

and / or,

When the detection type is security detection, the priority of the database instance whose priority is lower than the preset priority threshold is raised.
The method according to claim 1 or 2, wherein the one or more database instances are subjected to performance detection and/or security detection according to the adjusted priority, and performance detection results and/or security detection are obtained. The steps of the result include:

Determining the performance status of the one or more database instances according to the adjusted priority;

When the performance state meets a preset low performance condition, performing performance detection on the database instance to obtain a performance detection result.
The method according to claim 3, wherein the step of determining the performance status of the one or more database instances according to the adjusted priority comprises:

Determining, according to the adjusted priority, at least one of a CPU usage, an I/O read/write frequency, a connection number, and a disk space usage rate of the one or more database instances;

Wherein, the performance state satisfies a preset low performance condition when at least one of the following conditions is met:

The CPU utilization is higher than a preset utilization threshold, the I/O read/write frequency is higher than a preset read/write frequency threshold, the connection number is greater than a preset connection number threshold, and the disk space usage rate is Greater than the preset usage threshold.
The method according to claim 3, wherein the step of performing performance detection on the database instance to obtain a performance detection result comprises:

Performing performance detection on at least one attribute of the configuration, table structure, SQL statement, and architecture of the database instance, and obtaining at least one performance detection of configuration detection result, table structure detection result, SQL statement detection result, and architecture detection result result.
The method according to claim 5, wherein when the performance detection result and/or the security detection result matches a preset performance problem and/or a security problem, generating database processing prompt information The steps include:

When the configuration detection result matches the preset low configuration condition, generating database processing prompt information of the elevated configuration;

and / or,

When the table structure detection result matches the preset unreasonable structural condition, generating database processing prompt information of the adjustment table structure;

and / or,

When the SQL statement detection result matches the preset problem statement condition, generating database processing prompt information for modifying the SQL statement;

and / or,

When the architecture detection result matches the preset problem architecture condition, the database processing prompt information of the adjustment architecture is generated.
The method according to claim 1 or 2, wherein the one or more database instances are subjected to performance detection and/or security detection according to the adjusted priority, and performance detection results and/or security detection are obtained. The steps of the result include:

Grab the data packets sent to the one or more database instances according to the adjusted priority;

Performing at least one security detection in the password cracking, SQL injection, and whitelisting of the data packet to obtain a secret At least one of the code detection result, the SQL injection detection result, and the white list detection result.
The method according to claim 7, wherein the generating database processing prompt information is generated when the performance detection result and/or the security detection result match a preset performance problem and/or a security problem. The steps include:

When the password crack detection result indicates that the password cracking behavior occurs, generating database processing prompt information of at least one of the attack source, the whitelist adjustment, and the adjustment password;

and / or,

When the SQL injection detection result indicates that the SQL injection behavior occurs, generating a current SQL statement and checking database processing prompt information of at least one of the application programs;

and / or,

When the whitelist result matches the preset large-range condition, the database processing prompt information for modifying the whitelist is generated.
A cloud-based database detecting apparatus, comprising:

a detection type determining module, configured to determine a type of detection for detecting one or more database instances; the type of detection includes performance detection and/or security detection;

a priority adjustment module, configured to adjust a priority of the one or more database instances according to the detection type;

a detecting module, configured to perform performance detection and/or security detection on the one or more database instances according to the adjusted priority, and obtain performance testing results and/or security testing results;

a prompt information generating module, configured to generate database processing prompt information when the performance detection result and/or the security detection result match a preset performance problem and/or a security problem;

The pushing module is configured to push the performance detection result and/or the security detection result and the database processing prompt information.
The apparatus according to claim 9, wherein the priority adjustment module comprises:

a first improvement submodule, configured to increase a priority of a database instance that meets a preset low performance condition when the detection type is performance detection;

and / or,

a second improvement submodule, configured to: when the detection type is performance detection, increase a priority of a database instance whose calling frequency is higher than a preset frequency threshold;

and / or,

The third improvement sub-module is configured to: when the detection type is security detection, increase the priority of the database instance whose creation time is less than a preset time threshold;

and / or,

The fourth improvement submodule is configured to: when the detection type is security detection, increase the priority of the database instance whose priority is lower than the preset priority threshold.