TWM674713U - Data Query System - Google Patents

Abstract

A data query system includes a communication unit that establishes a communication channel with a client device, a storage unit with a built-in database, and a processing unit. The processing unit receives login information and a query request about a user input by the client device through the communication unit, obtains a recent query history of the user from the database of the storage unit based on the login information, and analyzes the content of the query request and the recent query history to predict a query request of the user. A query pattern and a risk level are calculated and an attack behavior determination result is generated. The processing unit determines, based on the query pattern, whether to adjust access permissions associated with the login information and used to access the database. The processing unit also determines, based on the risk level and the attack behavior determination result, whether to take corresponding protective measures for the client device and whether to generate a corresponding strategic response message. The processing unit then transmits the strategic response message to the client device via the communication unit.

Description

Data Query System

This invention relates to a query system, and in particular to a data query system that flexibly adjusts access permissions based on user operating behavior.

Traditional database system access control and security monitoring mechanisms typically use static rules and predefined anomaly patterns to identify unusual access behaviors. However, this approach is inadequate to address increasingly complex and dynamic security threats. This is because existing technologies lack a deep understanding of user behavior to flexibly adjust security access policies. Consequently, they fail to optimize the user experience while ensuring security, and can easily cause unnecessary disruption to users engaged in normal operations.

Therefore, the purpose of this invention is to provide a data query system that can analyze user behavior and generate security policies based on the analysis results to dynamically adjust user access rights to the database. This prevents users from stealing sensitive information in the database and avoids unnecessary interference with normal user operations.

Therefore, the present invention provides a novel data query system capable of communicating with a client device and comprising a communication unit, a storage unit, and a processing unit. The communication unit establishes a communication channel with the client device; the storage unit has a built-in database; the processing unit is electrically connected to the communication unit and the storage unit to communicate with the client device via the communication unit and access the storage unit. The processing unit also includes a chatbot and a generative adaptive security policy generation system. The generative adaptive security policy generation system includes a user behavior and intent analysis model and a security policy generation model.

The user behavior and intent analysis model communicates with the chatbot and receives login information and a query request regarding a user input from the client device from the chatbot. The user behavior and intent analysis model retrieves the user's recent query history from the database based on the login information and analyzes the content of the query request and the recent query history to predict a query pattern and a risk level for the user and generate an attack behavior determination result.

The security policy generation model obtains the login information, the query pattern, the risk level, and the attack behavior judgment result from the user behavior and intent analysis model. Based on the query pattern, the model determines whether to adjust access permissions associated with the login information and used to access the database. Based on the risk level and the attack behavior judgment result, the model determines whether to take corresponding protective measures for the client device and whether to generate a corresponding strategic response message. The model then provides the strategic response message to the client device via the chatbot.

In some embodiments of the present invention, the user behavior and intent analysis model includes a user behavior analysis module, a real-time intent analysis module, an abnormal operation detection module, and an attack behavior judgment module. The user behavior analysis module analyzes the recent query history to evaluate user behavior based on the query operation frequency, query content relevance, and query time characteristics contained in the recent query history to predict the user's query pattern, and provides an operation feature related to the recent query history to the abnormal operation detection module. The normal operation detection module includes a real-time intent analysis module that analyzes the query request content to predict the user's real-time intent and potential risk. The abnormal operation detection module determines whether the operation is abnormal based on the operation characteristics, including the operation time, the Internet protocol address of the client device, the operation frequency, and the query mode, and generates the risk level. The attack behavior judgment module generates the attack behavior judgment result based on the real-time intent and potential risk predicted by the real-time intent analysis module.

In some embodiments of the present invention, the security policy generation model includes a dynamic access control module, an intelligent blocking module, and a strict response control module. The dynamic access control module generates a corresponding access policy based on the query pattern and adjusts the access rights based on the access policy. The intelligent blocking module determines whether to take the corresponding protective measures for the client device based on the risk level and the attack behavior determination result generated by the attack behavior determination module. The strict response control module determines whether to generate the corresponding strategic response message based on the attack behavior determination result.

In some embodiments of the present invention, the user behavior analysis module and the real-time intent analysis module each utilize a pre-trained machine learning engine. Each machine learning engine is pre-trained based on a plurality of user operation behavior data. The abnormal operation detection module and the attack behavior judgment module each utilize a pre-trained machine learning engine. The machine learning engine of the abnormal operation detection module is pre-trained based on a plurality of preset operation feature data. The machine learning engine of the attack behavior judgment module is pre-trained based on a plurality of query intent and potential risk data.

In some embodiments of the present invention, the dynamic access control module, the intelligent blocking module, and the strict response control module each utilize a rule engine. The rule engine of the dynamic access control module determines the access rights corresponding to the query pattern based on an access control rule; the rule engine of the intelligent blocking module determines the risk level and the protective measures corresponding to the attack behavior determination result based on a blocking rule; and the rule engine of the strict response control module determines whether to generate the strategic response message corresponding to the attack behavior determination result based on a response rule.

In some embodiments of the present invention, when the attack behavior determination result determines that the query request is an attack behavior, a continuous optimization module of the generative adaptive security policy generation system applies a generative adversarial network (GAN) to generate a simulated query request with an attack scenario similar to the query request based on the query request and its associated query pattern, operational characteristics, risk level, immediate intent, potential risk, and attack behavior. The module then provides the simulated query request to the user behavior and intent analysis model to continuously train and optimize the user behavior and intent analysis model and the security policy generation model.

In some embodiments of the present invention, the dynamic access control module, the intelligent blocking module, and the strict response control module generate graded access policies, protective measures, and strategic response messages based on the query pattern, risk level, and attack behavior judgment result provided by the user behavior and intent analysis model, and adopt the access policies, protective measures, and strategic response messages of the same grade. Furthermore, the dynamic access control module, the intelligent blocking module, and the strict response control module progressively adopt the access policies, protective measures, and strategic response messages of the same grade based on the query pattern, risk level, and threat level of the attack behavior judgment result provided by the user behavior and intent analysis model.

This new technology enhances internal threat defenses by accurately identifying complex and long-term abnormal operating patterns through deep learning. It also leverages natural language processing technology to deeply understand the underlying intent of user queries, minimizing disruption to normal operations. It also uses multimodal AI to comprehensively analyze and predict potential attack behaviors, enhancing attack prevention capabilities. Furthermore, it leverages generative AI to dynamically generate and optimize security measures, increasing system security intelligence. Furthermore, it continuously optimizes the system to continuously enhance its overall defense capabilities, achieving adaptive defense.

1: Client device

2: Data Query System

21: Communication unit

22: Storage unit

23: Processing unit

24:Database

25: Chatbot

3: Generative Adaptive Security Policy Generation System

31: User Behavior and Intention Analysis Model

311: User Behavior Analysis Module

312: Real-time Intent Analysis Module

313: Abnormal Operation Detection Module

314: Attack Behavior Judgment Module

32: Security Policy Generation Model

321: Dynamic Access Control Module

322: Intelligent Blocking Module

323: Strict Response Control Module

33: Continuous Optimization Module

S1~S3: Steps

Other features and functions of this novel system are clearly illustrated in the accompanying drawings, including: Figure 1 is a block diagram of the main components of one embodiment of this novel data query system; Figure 2 illustrates the main process steps of this embodiment; and Figure 3 is a schematic diagram illustrating the relationships between the various modules of this embodiment.

Before the present invention is described in detail, it should be noted that similar components are represented by the same reference numerals in the following description.

Referring to Figure 1, an embodiment of the novel data query system is shown. It can communicate with a client device 1, implement the process steps shown in Figure 2 based on query requests from the client device 1, and automatically generate adaptive security policies to prevent users from stealing sensitive information. The data query system 2 is a database server, primarily comprising a communication unit 21, a storage unit 22, and a processing unit 23. The communication unit 21 is a communication interface (e.g., a network card) that can connect to the client device 1 via, for example, the internet to establish a communication channel. The storage unit 22 is a general term for a computer-readable recording medium (such as a memory module) for storing data, which contains a database 24 that stores specific data that can be queried (depending on the purpose of the database).

The processing unit 23, for example, a central processing unit (CPU) or a processor with similar functionality, is electrically connected to the communication unit 21 and the storage unit 22 to communicate with the client device 1 via the communication unit 21 and access data from the storage unit 22. Furthermore, the processing unit 23 reads a software program from a computer-readable recording medium (e.g., the storage unit 22) and installs a generative adaptive security policy generation system 3 included in the software program into the storage unit 22 to execute the generative adaptive security policy generation system 3. The generative adaptive security policy generation system 3 interacts with a chatbot (or customer service robot) 25 executed in the processing unit 23 to exchange and provide information. The chat robot 25 mainly receives a query request input by the client device 1 through the communication unit 21 and responds to the query request.

As shown in Figure 1, the generative adaptive security policy generation system 3 primarily includes a user behavior and intent analysis model 31 and a security policy generation model 32. When a user logs into the data query system 2 via the client device 1 by entering login information, the chatbot 25 asks the user what information they wish to query and accepts a query request (which may be voice or text) entered by the user via the client device 1. Then, as shown in step S1 of Figure 2, the chatbot 25 provides the login information and query request to the user behavior and intent analysis model 31.

Next, as shown in step S2 of Figure 2 , the user behavior and intent analysis model 31 retrieves the user's recent query history (e.g., query records within a day, week, or month) from the database 24 based on the login information. The model analyzes the query request content and the recent query history to predict the user's query pattern and risk level, generating an attack behavior judgment result. The model then provides the login information, query pattern, risk level, and attack behavior judgment result to the security policy generation model 32.

Specifically, as shown in Figures 1 and 3, the user behavior and intention analysis model 31 includes a user behavior analysis module 311, a real-time intention analysis module 312, an abnormal operation detection module 313, and an attack behavior judgment module 314, which have been pre-trained through machine learning. In this embodiment, the user behavior analysis module 311 and the real-time intention analysis module 312 each utilize a machine learning engine (e.g., a generative AI using a large language model or a generative AI using a natural language processing (NLP) model), and each machine learning engine pre-trains the model based on a plurality of user operation behavior data. (stored in the database 24) to complete pre-training through machine learning; the abnormal operation detection module 313 and the attack behavior judgment module 314 also each employ a machine learning engine (e.g., a deep learning artificial intelligence (AI) model and a multimodal artificial intelligence (AI) model). The machine learning engine of the abnormal operation detection module 313 performs machine learning based on a plurality of preset operation feature data (stored in the database 24) to complete pre-training; the machine learning engine of the attack behavior judgment module 314 performs machine learning based on a plurality of query intent and potential risk data to complete pre-training.

During the training process for these modules, different prompts will be designed for each module to enable them to achieve different functions. An example is shown below.

The following prompt will be given for this user behavior analysis module 311: Analysis Role: Security Auditor

Task: Analyze the following user behavior sequence to determine whether there are any abnormal patterns.

Evaluation dimensions: operation frequency, content relevance, and time characteristics

Output requirements: Provide abnormal risk rating (query mode) and specific reasons

The following prompt will be given for the real-time intent analysis module 312: Analysis Role: Information Security Expert

Task: Deeply analyze the underlying intent of this query

Evaluation dimensions: sensitivity, purposefulness, potential risk

Output requirements: Provide intention assessment report (real-time intention) and risk level (potential risk)

In this way, the user behavior analysis module 311 analyzes the user's recent query history to assess user behavior based on the query operation frequency, query content relevance, and query time characteristics contained in the recent query history, thereby predicting the user's query pattern and providing an operation characteristic related to the recent query history to the abnormal operation detection module 313. For example, if the recent query history includes content such as "How to query employee data?", "Where is the HR department's data stored?", or "How to apply for database access rights?", the user behavior analysis module 311 will determine that the query pattern is a systematic information detection behavior because the query pattern indicates that the user is trying to understand the system architecture and data access methods.

The real-time intent analysis module 312 analyzes the query request to predict the user's real-time intent and potential risk. For example, if the query request is "Please help me find a list of all employees with a salary exceeding 1 million, including their departments and positions," the real-time intent analysis module 312 will perform deep semantic analysis on the query request to identify keywords such as "salary, employee list, department, position," and determine the query purpose (real-time intent) as "attempting to obtain sensitive employee salary information" and assess the potential risk as "possible privacy breach and insider threat."

Similarly, the abnormal operation detection module 313 and the attack behavior judgment module 314 will also be pre-trained in a similar manner to the above examples and will independently fine-tune and judge based on the information received.

Thus, the abnormal operation detection module 313 can determine whether the operation is abnormal and generate the risk level based on the operation characteristics provided by the user behavior analysis module 311 (including the operation time, the Internet Protocol (IP) address of the client device 1, the operation frequency, and the query pattern). For example, if the operation time is outside working hours (such as 11 pm), the IP address is not a common IP address, the operation frequency is too frequent (such as 10 related queries in the past hour), and the query pattern indicates systematic detection of sensitive information, the abnormal operation detection module 313 will determine that this is a high-risk abnormal operation pattern and generate a high risk level.

The attack behavior determination module 314 generates the attack behavior determination result based on the real-time intent and potential risk predicted by the real-time intent analysis module 312. For example, if the real-time intent and potential risk indicate abnormal recent user behavior patterns, the query content involves sensitive information, the operation time and location are unusual, or typical information detection characteristics are displayed, the attack behavior determination result indicates that the attack behavior is highly likely to be an information theft attempt.

Next, as shown in step S3 of Figure 2 , the security policy generation model 32 determines, based on the query pattern, whether to adjust the user's access rights associated with the login information and used to access the database 24 . Furthermore, based on the risk level and the attack behavior assessment result, it determines whether to take corresponding protective measures for the client device 1 and whether to generate a corresponding strategic response message. The strategic response message is then provided to the client device 1 via the chatbot 25 .

Specifically, as shown in FIG1 and FIG3, the security policy generation model 32 of this embodiment includes a pre-trained dynamic access control module 321, an intelligent blocking module 322, and a strict response control module 323. The dynamic access control module 321, the intelligent blocking module 322, and the strict response control module 323 each include a rules engine. The rules engine (e.g., a generative AI model) of the dynamic access control module 321 is pre-trained with an access control rule and can generate an access policy corresponding to the query pattern based on the access control rule and adjust the access rights according to the access policy; the rules engine (e.g., an adaptive AI model) of the intelligent blocking module 322 is pre-trained with an access control rule. The AI model is pre-trained with a blocking rule and can generate the protective measures corresponding to the risk level and the attack behavior judgment result based on the blocking rule. The rule engine (e.g., a generative AI model) of the strict response control module 323 is pre-trained with a response rule and can determine whether to generate the strategic response message corresponding to the attack behavior judgment result based on the response rule.

For example, the dynamic access control module 321 will first check the user's permission information based on the login information as follows: User role: Administrator

Department: Sales Department

Standard permissions: Can query employee information of the department to which you belong

The dynamic access control module 321 then generates new access control rules based on the access policy, such as temporarily reducing the user's access permissions to the database 24 or increasing access restrictions on the user's access to sensitive information in the database 24.

The intelligent blocking module 322 can generate graded protective measures based on the risk level and the attack behavior judgment result (for example, if the attack behavior is determined to be highly likely an information theft attempt), such as first-level protective measures, second-level protective measures, and third-level protective measures, where:

First level protection measure: Provide obfuscated information to the chatbot 25, which then responds with the obfuscated information to the client device 1.

Second level protection measures: The chat robot 25 requires the user of the client device 1 to perform additional identity verification, such as adding OTP verification.

Third-level protection measure: Temporarily freeze the user's query permissions.

The intelligent blocking module 322 then determines which level of protection to adopt based on the number of related query requests associated with the login information. For example, if the query request is the first time, the first level of protection is adopted. If a similar query request is made a second time, the second level of protection is adopted, and so on. In this way, the overall defense capabilities of the system are gradually enhanced.

At the same time, the strict response control module 323 generates a corresponding strategic response message based on the attack behavior judgment result. For example, if the attack behavior judgment result determines that it is highly likely an attack behavior that attempts information theft, the content of the strategic response message may be, for example, "Based on information security policies, this type of sensitive information query requires additional authorization. Please formally apply for access rights through the human resources department. To protect personal privacy, the system cannot directly provide detailed salary information. If you need to know the salary range information, you can consult your direct supervisor."

Furthermore, in this embodiment, in the following scenario, if a user attempts to query sensitive information of different levels multiple times within a short period of time, the dynamic access control module 321, the intelligent blocking module 322, and the strict response control module 323 will synchronize and implement a progressive protection response based on the threat level of the query content, as follows.

When a user first submits a query request (a less sensitive query): "Please list the email addresses of all department heads," the dynamic access control module 321, the intelligent blocking module 322, and the strict response control module 323 each simultaneously take one of the following measures based on the query pattern, risk level, and attack behavior judgment result provided by the user behavior and intent analysis model 31:

When the same user submits a second query request (a moderately sensitive query): "Need access to all reports in the Finance Department," the dynamic access control module 321, the intelligent blocking module 322, and the strict response control module 323 each simultaneously take one of the following measures based on the query pattern, risk level, and attack behavior judgment result provided by the user behavior and intent analysis model 31:

When the same user makes a third query (a highly sensitive query): "Please provide access to all encryption keys," the dynamic access control module 321, the intelligent blocking module 322, and the strict response control module 323 each simultaneously take one of the following measures based on the query pattern, risk level, and attack behavior judgment result provided by the user behavior and intent analysis model 31:

From this, we can see that the design principles of the above linkage mechanism are as follows:

1. Phased upgrade:

All three modules increase the response level simultaneously.

Maintain consistency in protective measures.

Avoid conflicts in protection strength.

2. Situational Awareness:

The three modules share threat assessment results.

The three modules use unified judgment criteria.

The three modules coordinate the response strategy.

Furthermore, when the attack behavior judgment result determines that the query request is an attack behavior, a continuous optimization module 33 of the generative adaptive security policy generation system 3 records the query request and its related query mode, the operation characteristics, the risk level, the immediate intention and potential risk, and the attack behavior; and the continuous optimization module 33 applies a generative adversarial network (GAN) according to the query request. The system generates one or more simulated query requests for attack scenarios similar to the query request and provides the simulated query request(s) to the user behavior and intent analysis model 31 to continuously train and optimize the user behavior and intent analysis model 31 and the security policy generation model 32.

From the above description, it can be seen that the user behavior and intention analysis model 31 of this embodiment accurately identifies complex and long-term abnormal operation patterns through deep learning, enhances internal threat defense, and uses natural language processing technology to deeply understand the potential intention of user queries to reduce interference with normal operations and optimize user experience. It also uses multimodal AI to comprehensively analyze and predict potential attack behaviors and enhance attack prevention capabilities; and the security policy generation model 32 uses natural language processing technology to accurately identify complex and long-term abnormal operation patterns, enhance internal threat defense, and enhance internal threat defense capabilities. Formulated AI dynamically generates and optimizes security protection measures (strategies), improving the system's security intelligence. Furthermore, the continuous optimization module 33 continuously generates and provides query requests for simulated attack scenarios to the user behavior and intent analysis model 31, thereby continuously training and optimizing the user behavior and intent analysis model 31 and the security strategy generation model 32. This continuously enhances the system's overall defense capabilities and implements adaptive defense, effectively achieving the efficacy and purpose of this novel technology.

However, the above descriptions are merely examples of embodiments of this new invention and should not be construed as limiting the scope of implementation of this new invention. All simple equivalent variations and modifications made within the scope of this patent application and the contents of the patent specification are still covered by this new patent.

1: Client device

2: Data Query System

21: Communication unit

22: Storage unit

23: Processing unit

24:Database

25: Chatbot

3: Generative Adaptive Security Policy Generation System

31: User Behavior and Intention Analysis Model

311: User Behavior Analysis Module

312: Real-time Intent Analysis Module

313: Abnormal Operation Detection Module

314: Attack Behavior Judgment Module

32: Security Policy Generation Model

321: Dynamic Access Control Module

322: Intelligent Blocking Module

323: Strict Response Control Module

33: Continuous Optimization Module

Claims (7)

A data query system capable of communicating with a client device includes: a communication unit that establishes a communication channel with the client device; a storage unit having a built-in database; and a processing unit electrically connected to the communication unit and the storage unit to communicate with the client device through the communication unit and access the storage unit. The processing unit includes a chat robot and a generative self-adaptive security policy generation system, wherein the generative self-adaptive security policy generation system includes a user behavior and intention analysis model and a security policy generation model. The user behavior and intent analysis model communicates with the chatbot and receives login information and a query request regarding a user input from the client device from the chatbot. The user behavior and intent analysis model retrieves a recent query history of the user from the database based on the login information, analyzes the content of the query request and the recent query history, and predicts a query pattern and a risk level of the user to generate an attack behavior determination result. The security policy generation model obtains the login information, the query pattern, the risk level, and the attack behavior judgment result from the user behavior and intent analysis model, and determines whether to adjust the access rights related to the login information and used to access the database based on the query pattern. It also determines whether to take corresponding protective measures for the client device and whether to generate a corresponding strategic response message based on the risk level and the attack behavior judgment result, and provides the strategic response message to the client device through the chat robot. The data query system as described in claim 1, wherein the user behavior and intention analysis model includes a user behavior analysis module, a real-time intention analysis module, an abnormal operation detection module, and an attack behavior judgment module; the user behavior analysis module analyzes the recent query history to evaluate the user behavior based on the query operation frequency, query content relevance, and query time characteristics contained in the recent query history to predict the user's query pattern, and provides an operation feature related to the recent query history to the user. The abnormal operation detection module; the real-time intent analysis module analyzes the content of the query request to predict the user's real-time intent and potential risk; the abnormal operation detection module determines whether it is an abnormal operation based on the operation characteristics and generates the risk level, the operation characteristics including the operation time, the Internet protocol address of the client device, the operation frequency, and the query mode; the attack behavior judgment module generates the attack behavior judgment result based on the real-time intent and potential risk predicted by the real-time intent analysis module. A data query system as described in claim 2, wherein the security policy generation model includes a dynamic access control module, an intelligent blocking module, and a strict response control module; the dynamic access control module generates a corresponding access policy based on the query mode and adjusts the access right based on the access policy; the intelligent blocking module determines whether to take the corresponding protective measures for the client device based on the risk level and the attack behavior judgment result generated by the attack behavior judgment module; and the strict response control module determines whether to generate the corresponding strategic response message based on the attack behavior judgment result. The data query system as described in claim 2, wherein the user behavior analysis module and the real-time intent analysis module each apply a pre-trained machine learning engine, and each machine learning engine performs machine learning based on a plurality of user operation behavior data to complete training; the abnormal operation detection module and the attack behavior judgment module each apply a pre-trained machine learning engine, and the machine learning engine of the abnormal operation detection module performs machine learning based on a plurality of preset operation feature data to complete training; and the machine learning engine of the attack behavior judgment module performs machine learning based on a plurality of query intentions and their potential risk data to complete training. A data query system as described in claim 3, wherein the dynamic access control module, the intelligent blocking module, and the strict response control module each apply a rule engine, the rule engine of the dynamic access control module determines the access right corresponding to the query mode according to an access control rule; the rule engine of the intelligent blocking module determines the risk level and the protective measures corresponding to the attack behavior judgment result according to a blocking rule; and the rule engine of the strict response control module determines whether to generate the strategic response message corresponding to the attack behavior judgment result according to a response rule. A data query system as described in claim 2, wherein, when the attack behavior judgment result determines that the query request is an attack behavior, a continuous optimization module of the generative adaptive security policy generation system applies a generative adversarial network to generate a simulated query request for an attack scenario similar to the query request based on the query request and its related query mode, the operation characteristics, the risk level, the immediate intention and potential risk, and the attack behavior, and provides the simulated query request to the user behavior and intention analysis model to continuously train and optimize the user behavior and intention analysis model and the security policy generation model. The data query system as described in claim 3, wherein the dynamic access control module, the intelligent blocking module, and the strict response control module generate the graded access strategy, the protective measures, and the strategic response message based on the query pattern, the risk level, and the attack behavior judgment result provided by the user behavior and intention analysis model, and adopt the access strategy, the protective measures, and the strategic response message of the same level; and the dynamic access control module, the intelligent blocking module, and the strict response control module gradually adopt the access strategy, the protective measures, and the strategic response message of the same level step by step based on the threat level of the query pattern, the risk level, and the attack behavior judgment result provided by the user behavior and intention analysis model.