TW201351171A - Network packet and database packet audit system and correlation auditing apparatus and method - Google Patents

Abstract

This invention relates to a network packet and database packet audit system and correlation auditing apparatus and method. The correlation auditing method is to acquire a plurality of HTTP network packets containing global resources addressing information and a plurality of SQL database packets containing SQL database statement, and count the amounts of various global resources addressing information and various SQL database statement respectively in a plurality of time intervals according the time points of receiving HTTP network packets and SQL database packets, for use as two sets of statistical samplings; then use the correlation extent of the two sets of statistical samplings to determine whether the global resources addressing information and the SQL database statement are correlated with each other; as such, the numerical calculation is used to replace the comparison step of parsing grammar which is complicated and has high calculation amount; thus lowering the calculation amount of the correlation audit to increase the operation performance.

Description

Network packet and database packet auditing system and related auditing device and method

The invention relates to a network packet and database packet auditing system and a related auditing device and method thereof, in particular to a network packet and database packet auditing system and a related auditing device and method for statistical numerical calculation, which are not A large amount of packet content analysis and comparison is needed to improve the computing performance and save the storage space of the package.

In view of the rapid development of the popularity and convenience of the Internet, the Internet has become the mainstream medium for transmitting information today. Various company lines and large hospitals have also established their own regional networks.

The popular and convenient Internet has also extended the issue of information security. Since everyone has the possibility to access and modify data through the Internet, it has been extended through the Internet to illegally access or To modify the behavior of the data, the above-mentioned access to the data through the Internet must be recorded as a basis for the investigation of the responsibility of the security. However, in the existing Internet, a web server (Web server) is used. ) for the user to connect, the user accesses the network data by transmitting an HTTP network packet (HTTP request) to the network server, and the network data provided by the network server is not stored in the network server. Instead, it is stored in a data server (Data Base sever, referred to as DB server), and is connected to the data server by the network server, and transmits a SQL database packet (SQL request) to the data server to obtain The network data to be provided to the user, but since the web server needs to be connected by many users, the web server mentions There are many ports for the user to connect, and the link to the data server is less than the connection to the user, so that multiple users share the connection to access the data server, so it is not possible. The connection is used to determine which user actually accessed the database.

To this end, there is a network packet and database packet auditing system, which mainly establishes the association between the HTTP network packet and the SQL database packet to achieve the purpose of security auditing. Please refer to Figure 9, the above network packet cum The database packet auditing system includes: A network packet listener 61 (HTTP Sniffer) is connected between a client terminal 51 and a network server 52 to capture a plurality of HTTP network packets transmitted by the client terminal 51 to the network server 52. And outputting the complex HTTP network packet, and each HTTP network packet includes a global resource locator (URL) and at least one webpage variable; An SQL database packet listener 62 (SQL Sniffer) is connected between the network server 52 and a data server 53 to retrieve the plurality of SQL data transmitted by the network server 52 to the data server 53. The library encapsulates the package and outputs the complex SQL database package, and each SQL database package includes a SQL database statement (SQL query); An association device 63 is connected to the network packet listener 61 and the SQL database packet listener 62, and has an association establishment program, an audit program, and a knowledge base, and alternates Executing the association establishing program and the auditing program, continuously receiving the complex HTTP network packet and the SQL database packet during the execution of the association establishing program, and acquiring the global resource addressing information in the HTTP network packet ( URL AD) and SQL database description in the SQL database package (SQL AC) establishes the relationship matrix as shown in FIG. 10, and presets the correlation scores of the global resource addressing information (URL AD) and the SQL database statement (SQL AC) corresponding to the plurality of HTTP network packets respectively. 0, and according to the degree of similarity of the complex HTTP network packet and the complex SQL database packet received thereafter (such as parsing the HTML text, determining whether the same statement or user ID is included), respectively, adding and subtracting global resource addressing information Corresponding to the score score of each SQL database statement, for example, receiving an HTTP network packet containing URL A, and the HTTP network packet contains a variable similar to SQL B, then the URL A corresponds to the SQL B column. The correlation score in the bit is added, and if it is completely different, the score is reduced, and the relationship matrix is stored in the knowledge base before the association establishment procedure is ended; during the execution of the audit procedure, the plural is continuously received. HTTP network packet and SQL database packet, and the correlation score of the relation matrix in the knowledge base is used as a basis for judging whether the HTTP network packet is related to the SQL database packet, so as to associate the HTTP network packet with the corresponding SQL capital Library packet establishing a set of audit data tables, queries for auditors.

After the association auditing device 63 executes the association establishment procedure and the auditing procedure, the generated auditing data table can know which HTTP network packet corresponds to which SQL database packet, since the HTTP network packet usually has the user's IP address. Information such as address or ID, and the SQL database package will have an instruction language for accessing the SQL database. You can find the SQL database package corresponding to the HTTP network packet, and you can know which client corresponds to which SQL data. Inventory take action.

However, since the correlation score value set by the above-mentioned correlation auditing device 63 is the HTTP network packet content corresponding to each global resource addressing information. (The sentences, variables, etc. contained in it) are calculated by comparing the contents of the SQL database package corresponding to the contents of the SQL database (including the sentences, variables, etc.), so a large amount of storage space is required for storage. The content contained in the network and SQL database package, and the SQL syntax must be parsed from the HTML document in the SQL database package, and the complex content comparison program is executed, so that the correlation auditing device 63 needs to perform a large number of operations; and the existing association The maximum computational load of the sexual auditing device 63 is usually only a load-related establishment procedure, and it is difficult to execute the auditing procedure at the same time, so that the association establishing procedure and the auditing procedure can only be executed alternately, and the auditing data table cannot be generated during the period in which the auditing procedure is stopped. The security loophole needs to be improved.

In view of the technical defects of the above-mentioned network packet and database packet auditing system, the main purpose of the present invention is to provide a network packet and database packet auditing system and its associated auditing method.

The main technical means used to achieve the above purpose is that the network packet and database packet auditing system includes: a network packet listener, which extracts a plurality of HTTP network packets and outputs the complex HTTP network packet. And each HTTP network packet includes at least one global resource addressing information (URL); a SQL database packet packet listener captures the complex SQL database packet, and outputs the complex SQL database packet, and each SQL database packet is at least Include a SQL database statement (SQL); an associated auditing device is connected to the network packet listener and the SQL database packet listener, and has an associated learning analysis program and an auditing program. The association learning analysis program is configured to divide the time of receiving the complex HTTP network packet and the SQL database packet into a complex time interval, and distribute the global resource addressing information in a plurality of intervals as a group of global the number of statistical samples S (X _i) resource addressing information, and various SQL databases Shuju distributed in the complex time interval as a set of SQL database Shuju statistical sample S (Y _i), and to assess the level of relevance and store the two groups in the number of statistical sample distribution, as a basis for determining whether the relevant information addressing various global information and various SQL databases Shuju room; the audit process in accordance with the Department The correlation between the number of segments in the two sets of statistical samples stored in the correlation learning analysis program, and whether the various global information addressing information is related to various SQL database statements to establish a set of audit information tables for The auditor inquires about the degree of relevance between the global resource location information and the SQL database statement.

In the existing network architecture, the SQL database packet is outputted by the network server receiving the HTTP network packet, so the associated auditing device usually takes a short time after extracting the HTTP network packet. Get the SQL database packet associated with the HTTP network packet, so the associated global resource addressing information and the statistical sample S(X _i ), S(Y _i ) of the SQL database statement relative to the time interval The distribution of the situation will be similar, so the present invention can use HTTP network packets containing various global resource addressing information and SQL database packages containing various SQL database statements, and the degree of correlation between the two in the time interval is found and The SQL database description corresponding to the global resource addressing information is used for the purpose of security audit.

And because the above-mentioned related auditing device counts the number of global resource addressing information and the SQL database statement respectively in a plurality of time intervals, Furthermore, the statistical correlation of the statistical sample distribution is used as a basis for judging whether the HTTP network packet is related or not. Therefore, only the number of calculations and the number of occurrences can be calculated, and the numerical operation can be performed without storing the HTTP network packet and the SQL database packet. The content does not need to be compared with its content, saving storage space and reducing computational complexity and improving system performance.

In view of the technical defects of the above-mentioned network packet and database packet auditing system, the secondary objective of the present invention is to avoid the vulnerability of the related learning analysis program and the auditing program, which is further caused by When the correlation auditing device executes the auditing program, the related learning analysis program is continuously and simultaneously executed to continuously update the correlation data between various global resource addressing information and various SQL database statements, so that the auditing program can update and judge various kinds in real time. The basis of whether the global resource addressing information is related to the various SQL database statements, and because the related learning analysis establishment procedure proposed by the present invention only needs to be numerically calculated, and the amount of calculation is small, the association learning analysis is also performed at the same time. The program and audit procedures are also less likely to exceed the computational load of the associated audit device.

Moreover, the main technical means used to achieve the above purpose is to make the network packet and database packet auditing system related auditing method include: capturing multiple HTTP network packets and complex SQL database packets, and each HTTP network The road packet includes a global resource addressing information, and each SQL database packet includes a SQL database statement; the time for capturing the complex HTTP network packet is divided into multiple time intervals, and various global resource addressing information is distributed. The number of multiple intervals is used as a statistical sample S(X _i ) of a set of global resource addressing information, and the number of various SQL database statements distributed in a complex time interval is used as a statistical sample of a set of SQL database statements. (Y _i ); evaluating and storing the degree of correlation of the quantity distribution in the two sets of statistical samples as a basis for judging whether the various global information addressing information is related to various SQL database statements; The degree of correlation of the quantity distribution in the two sets of statistical samples stored, and the judgment includes various global information addressing information and various SQL Whether the correlation between material libraries Shuju to establish a set of audit data table.

The technical means adopted by the present invention for achieving the intended purpose of the invention are further described below in conjunction with the drawings and preferred embodiments of the invention.

Referring to FIG. 1, the network packet and database packet auditing system of the present invention includes: a network packet listener 10, which continuously captures a plurality of HTTP network packets, and outputs the complex HTTP network packet, and each HTTP The network packet includes at least one global resource locator (URL); a SQL database packet listener 20 continuously extracts the complex SQL database packet, and outputs the complex SQL database packet, and each SQL data The library packet includes at least one SQL database statement (SQL query); an association auditing device 30 is connected to the network packet listener and the SQL database packet listener, and has an associated learning analysis program and An auditing program, the correlation learning analysis program is configured to divide the time of receiving the complex HTTP network packet and the SQL database packet into a complex time interval, and counting various global resource addressing information distributed in a plurality of intervals Quantity, as a statistical sample S(X _i ) of a set of global resource addressing information, and count the number of various SQL database statements distributed in a complex time interval for A statistical sample S(Y _i ) for a set of SQL databases, and evaluates and stores the degree of correlation of the quantity distributions in the two sets of statistical samples S(X _i ) and S(Y _i ). Whether the global information addressing information and the basis of various SQL database statements are related, so that the latest HTTP and SQL database packets received over time can update the basis of the correlation analysis and judgment according to the time; the auditing procedure is based on the association. The degree of correlation between the quantity distributions of the two sets of statistical samples S(X _i ) and S(Y _i ) stored in the sexual learning analysis program, and whether the various global information addressing information is related to various SQL database statements, A set of audit data tables is established. In this embodiment, the correlation learning analysis program calculates a correlation coefficient r (correlation coefficient) of the two sets of statistical samples S(X _i ) and S(Y _i ) distributed in each time interval. , which is The correlation coefficient is used as a basis for evaluating the correlation degree between the two sets of statistical samples S(X _i ) and S(Y _i ), and the calculated correlation coefficient and the correlation coefficient corresponding to the global resource addressing information and the SQL data library are stored. The auditing procedure determines whether the various global information addressing information is related to various SQL database statements based on the stored correlation coefficient values. The following is only further explained with the schema.

Referring to FIG. 2, the related learning analysis program includes the following steps: continuously receiving an HTTP network packet and a SQL database packet S11; and counting the number of global resource addressing information in the current time interval (Tb _N ) X _N And its square X _N ² , and accumulate to a quantity sum And a square sum And then map various global resources and their corresponding numbers (Tb _N , X _N ), quantity and time in each time zone. Square sum And the number of samples taken by the test|X|(the number of samples|X| is the number of time intervals corresponding to the distribution of various global resource addressing information) is stored in an HTTP hash table (Ssh), S12, In this embodiment, referring to Tb1~Tb4 of FIG. 3, the association auditing device 30 continues to receive the HTTP network packet by the network packet listener 10 before performing this step, and after receiving a full time interval. The HTTP network packet is sent out to the association auditing device 30, and the correlation auditing device sets a batch ID of the HTTP network packet according to the time interval in which the HTTP network packet is received, as shown in FIG. If the network packet listener 10 retrieves the global resource addressing information of the URL 2 and the URL 3 in the first time interval, the association auditing device 30 sets the global resource addressing information of the URL 2 and the URL 3 to the interval number of the Tb1. Re-counting the current time number, the number of global resource addressing information X _i and its square X _i ² for summing, and the HTTP network packet hash table is as shown in Figure 5, including the address information bar Bit, quantity and field, The number of squares and the fields, the same number field and the same distribution field, the sample distribution field stores the number of global resource addressing information distributed in each time interval (Tbi, Xi), such as (Tb2, 2) The information indicating that the global resource address information is included in the interval Tb2 is 2 times, and the sample number field stores the sample number of the various global resource addressing information collected; Counting the current time interval (Tb _N ), various SQL data The number of statements in the library, Y _N and its square Y _N 2, are added to a quantity sum And a square sum , then packetize various SQL databases and their corresponding numbers (Tb _N , Y _N ), quantity and time in each time interval Square sum And the number of samples taken by the test |Y|, that is, the number of time intervals corresponding to the distribution of the various SQL database statements, is stored in a SQL data library hash table (S9), in this embodiment, As shown in FIG. 3, Tb1~Tb4, the correlation auditing device 30 continues to receive the SQL database packet by the SQL database packet listener 20 before performing this step, and remits the SQL data after receiving a full time interval. The library packet is sent to the association auditing device 30, and the correlation auditing device 30 sets the batch ID of the SQL database according to the time interval to which the SQL database is received, as shown in FIG. 4, if SQL The database packet listener 20 retrieves the SQL database statement of SQL1, SQL2, and SQL3 in the first time interval, and the correlation auditing device 30 sets the SQL database description of the SQL1, SQL2, and SQL3 to a number. For the interval number of Tb1; recount the current interval number, the number of SQL database envelopes Y _i and its square Y _i ^{2 of} various SQL database statements for summation, and the SQL database package hash table is as shown in the figure 6 shows a SQL database statement field, The number and field, a quantity squared field, the same number field (renamed corresponding to the aforementioned "sample number") and the same distribution field, the sample distribution field stores the corresponding SQL database statement The SQL database packet is distributed in the number of time intervals (Tb _i , Y _i ), such as (Tb1, 1) is expressed in the SQL database containing the statement in the time interval 1 appears once, the SQL database packet hash The sample number field of the table stores the number of samples of the various SQL database statements; the current product time interval, the number of global resource addressing information and the number of various SQL database statements X _N × Y _N , and Accumulate to a product and , then the various global resource addressing information, various SQL database statements, the corresponding number product and the global resource addressing information and the number of intersections of the SQL database description samples | X Y|Save a sentence to the SQL-HTTP hash table S14, as shown in Figure 7; separately calculate the statistical sample S(X _i ) of various global information addressing information and various SQL database statements Correlation coefficient r between the statistical samples S(Y _i ), And the number of samples U=|X|+|Y|-|X Y|, the number of samples U will follow |X|, |Y|, and |X The number of Y| is changed differently, and various global information addressing information, various SQL database statements and corresponding correlation coefficients are stored in S15, and then return to step S11 of continuously receiving HTTP network packet and SQL database packet, And the above steps have been calculated separately Therefore, in this step, it is only necessary to multiply, divide, square, and open the numerical value of the above numerical values; the above-mentioned related learning analysis program is distributed in the time interval by global resource addressing information and SQL database description sentences. The correlation coefficient r is used to determine the correlation between the global resource addressing information and the SQL database statement. The higher the correlation coefficient r, the distribution of the occurrence time of the global resource addressing information and the occurrence of the SQL database statement. The higher the similarity of time distribution, the reason is that the network server in the network architecture can send the SQL containing the SQL database statement by receiving the HTTP network packet containing the global resource addressing information. Database package.

Moreover, since the correlation coefficient is calculated, only the sum of the quantity sum, the sum of squares and the product of the quantity need to be retained, and the sample distribution field in the HTTP network packet and the SQL database packet hash table does not need to be retained in essence. The purpose of reservation is to delete outdated relevance in the future, so a reserved data threshold can be preset in the association learning analysis program, and various data can be stored in the HTTP network packet hash table and various data stored in the SQL database. After the table, according to the threshold value of the reserved data, the earliest data of the time interval is deleted, for example, based on the time value, the threshold value of the reserved data is set to a time interval critical value, and the associated learning analysis program is the deletion time. The interval is earlier than all the data of the critical value of the time interval, and based on the data amount, the threshold value of the reserved data is set to a data amount value, and the related learning analysis program is to first delete the data with an earlier time interval. The relevance learned until the time threshold is forgotten until all data is less than the data amount.

Referring to FIG. 8 again, the auditing process includes the following steps: continuously receiving an HTTP network packet and a SQL database packet S21; and interpreting the global resource addressing information included in the HTTP network packet and the SQL database description. SQL database statement S22; Selecting various global resource addressing information for the correlation coefficient of various SQL database statements is greater than a preset value (for example, the preset value can be set to 0.5), and respectively corresponding HTTP network packet and SQL database packet Set to the associated S23 to establish the audit information table S24.

In this way, the audit data sheet can be audited, and the global resource address information of the HTTP network packet is audited corresponding to which SQL database package SQL database statement to know which user number user to use the network server. What instructions are issued to the SQL database.

Since the present invention determines whether the global resource addressing information and the SQL database statement are related by the correlation between the global resource addressing information and the distribution time point of the SQL database, in addition to the complex operations such as comparison content and HTML text parsing can be eliminated. Actions, as well as exempting the contents of storing a large number of packets, and since the present invention calculates the correlation coefficient, it is only necessary to retain various sums, sums of squares, and product sums. Therefore, when the correlation learning analysis program is continuously executed, the calculated values are calculated. (Performing the value calculated after step S17 and returning to step S11) can be added to each previously calculated value to calculate a new correlation coefficient; for example, after the time interval from Tb1 to Tb4 is captured, Each value of N=4 has been stored, and when each value is counted in the time interval Tb5, Therefore, it is only necessary to calculate the values X _{5 of the} time interval ₅ , When Y ₅ , Y ₅ ² and X ₅ Y ₅ are summed up with the values calculated by the previous N=4, the values of N=5 can be calculated to calculate the correlation coefficient; similarly, N=200 is calculated. When the value of N=199 has been stored, the correlation auditing device 30 only needs to calculate the values of N=200, and does not increase the storage space and the amount of calculation, and can be made after multiple calculations. The correlation coefficient obtained reflects the relevance of the global resource addressing information and the SQL database statement received since the beginning of the association learning analysis program; compared to the prior art to compare the contents of the packet, the number of packets will be The storage capacity and the maximum computational load limit cannot store all the packets and compare the contents, so the invention can also have higher accuracy.

In summary, the correlation auditing apparatus of the present invention can calculate the correlation coefficient by calculating the global resource allocation information and the statistical sample of the SQL database for each time interval, and determine the global resource addressing information and the SQL database. Whether or not the relevant basis can replace the complicated and computationally high content comparison steps by numerical calculation, so as to greatly reduce the amount of calculation and avoid storing a large amount of package contents, so that the related learning analysis program can be executed together with the audit program, and further Avoid the occurrence of security loopholes, and after the implementation for a period of time (after multiple time intervals), the initial received global resource addressing information and SQL database statement can be compared with time without increasing the storage space and the amount of computation. The interval distribution is reflected in the newly calculated correlation coefficient, and the accuracy of the judgment can be improved without increasing the amount of calculation.

10‧‧‧Network Packet Listener

20‧‧‧SQL database packet listener

30‧‧‧Related auditing device

51‧‧‧User

52‧‧‧Web server

53‧‧‧Database Server

61‧‧‧Network Packet Listener

62‧‧‧SQL database packet listener

63‧‧‧Related auditing device

FIG. 1 is a block diagram of a network packet and database packet auditing system of the present invention.

2 is a flow chart of the association learning analysis program in the correlation auditing apparatus of FIG. 1.

FIG. 3 is a schematic diagram showing the time interval distribution of the network packet flow and the SQL data packet flow of the correlation auditing apparatus of FIG. 1 .

FIG. 4 is a section number table for dividing the HTTP network packet and the SQL database packet into a complex time interval for the associative auditing apparatus of FIG. 1.

Figure 5: The HTTP network packet hash table established by the step of storing the count number into the HTTP network packet hash table in Figure 2.

Figure 6: The SQL database packet hash table created by the step of storing the count quantity into the SQL database packet hash table in Figure 2.

Fig. 7 is a hash table of the address-to-address information established for the step of calculating the calculated quantity product and storing the sentence into the address information hash table.

Figure 8 is a flow chart of the auditing procedure in the associated auditing apparatus of Figure 1.

Figure 9 is a block diagram showing the existing network packet and database packet auditing system installed in the existing network architecture.

Figure 10: Relationship matrix table established for an existing correlation audit device.

Claims (27)

A network packet and database packet auditing system includes: a network packet listener, which extracts a plurality of HTTP network packets, and outputs the plurality of HTTP network packets, and each HTTP network packet includes at least one global Resource addressing information; a SQL database packet listener, is to capture the complex SQL database package, and output the complex SQL database package, and each SQL database package contains at least one SQL database statement; an associated audit device And connecting to the network packet listener and the SQL database packet listener, and having an associated learning analysis program and an auditing program, the related learning analysis program is to receive the complex HTTP network when executed The time of the road packet and the SQL database packet is divided into a complex time interval, and the number of global resource addressing information distributed in the plurality of intervals is used as a statistical sample S(X _i ) of the global resource addressing information, and the SQL data is used. number library Shuju distributed in a plurality of time intervals as a set of SQL database Shuju statistical sample S (Y _i), and storing the second set and evaluate statistical sample number The degree of relevance of the cloth is used as a basis for judging whether the various global information addressing information is related to various SQL database statements; the auditing procedure is based on the quantity distribution of the two sets of statistical samples stored in the association learning analysis program. The degree of relevance is related to whether the HTTP network packets of various global information addressing information are related to various SQL database statements to establish a set of audit data sheets. The network packet and database packet auditing system according to claim 1, wherein the correlation learning analysis program calculates correlation coefficients of the two sets of statistical samples distributed in each time interval, and uses the correlation coefficient as an evaluation global resource. The statistical sample of the address information and the basis of the correlation between the statistical samples of the SQL database statement, and store the calculated correlation coefficient and the global resource location information corresponding to the correlation coefficient and the SQL database statement; the audit procedure is based on the stored The correlation coefficient value is used to determine whether various global information addressing information is related to various SQL database statements. The network packet and database packet auditing system according to claim 2, wherein when the correlation auditing device executes the auditing program, the related learning analysis program is continuously and simultaneously executed. The network packet and database packet auditing system according to claim 2 or 3, wherein the association learning analysis program comprises the following steps: continuously receiving an HTTP network packet and a SQL database packet; and counting the current time interval (Tb _N ) Within, the number of global resource addressing information X _N and its square X _N ² , and accumulate to a quantity and And a square sum And then map various global resources and their corresponding numbers (Tb _N , X _N ), quantity and time in each time zone. Square sum And the number of samples taken |X| is stored in an HTTP network packet hash table; counting the current time interval (Tb _N ), the number of various SQL database statements Y _N and its square Y _N ² , and accumulating To a quantity and And a square sum , then packetize various SQL databases and their corresponding numbers (Tb _N , Y _N ), quantity and time in each time interval Square sum And the number of samples taken in the |Y| is stored in a hash table of the SQL database; in the current time interval, the number of the global resource addressing information and the number of SQL database envelopes of various SQL database statements are calculated X _N × Y _N and accumulate to a product sum Then, the global resource addressing information, the SQL database statement, the corresponding quantity product, and the intersection of the global resource addressing information and the SQL database description sample |X Y | Shuju into a resource for addressing hash table inside; correlation coefficient r is calculated between the various statistical sample S (X _i) global information addressing information with a variety of SQL databases Shuju statistical sample S (Y _i), And the number of samples U=|X|+|Y|-|X Y|, and store various global information addressing information, various SQL database statements and corresponding correlation coefficients, and return to the steps of continuously receiving HTTP network packets and SQL database packets. The network packet and database packet auditing system according to claim 4, wherein the HTTP network packet hash table includes an address information field, a quantity and a field, a quantity squared field, a same number field, and a sample distribution field, wherein the sample distribution field stores a quantity (Tb _i , X _i ) corresponding to various global resource addressing information distributed in each time interval, and the sample number field stores and counts various global resource addressing information. The number of samples taken; and the SQL database package hash table contains a SQL database statement field, a quantity and field, a quantity squared field, the same number field and the same distribution field, SQL The sample distribution field of the database packet hash table stores the number of various SQL database statements distributed in each time interval (Tb _i , Y _i ), and the sample number field of the SQL database packet hash table stores various SQL data. The number of samples taken during the library statement. The requested item database packet network packet cum audit system of claim 5, wherein the means for counting the current association audit the time interval and the number of square X _i X _i global addressing information of the resource prior to step ^2, of the web-based The packet packet listener continuously receives the HTTP network packet, and remits the HTTP network packet to the association auditing device after receiving the time interval, and the correlation auditing device sets the time interval according to the time interval of receiving the HTTP network packet. Global resource addressing information is an interval number, and then counts the current time number, the number of global resource addressing information X _i and its square X _i ² for summation; and the correlation auditing device counts the SQL database in the current time interval. Before the step of the number Y _i and the square Y _i ² of the sentence, the SQL database packet listener continuously receives the SQL database packet, and after receiving the full time interval, remits the SQL database package to the associated auditing device. The correlation auditing device sets the interval number of the SQL database to the interval according to the time interval of receiving the SQL database packet, and then counts the current interval. No., number of various SQL databases Shuju Y _i and Y _i ² squares, to be summed. For the network packet and database packet auditing system described in claim 6, the associated learning analysis program presets a reserved data threshold, and stores various data in the HTTP network packet hash table and the SQL database hash. After the table, the data with the earliest time interval is deleted according to the reserved data threshold. The network packet and database packet auditing system according to claim 7 is configured to set a threshold value of the reserved data as a time threshold, and the associated learning analysis program deletes all data whose time interval is earlier than the time threshold. . The network packet and database packet auditing system according to claim 8, wherein the auditing process comprises the steps of: continuously receiving an HTTP network packet and a SQL database packet; and interpreting global resource addressing information included in the HTTP network packet and The SQL database contains the SQL database description; selects various global resource addressing information for the correlation coefficient of various SQL database statements higher than a preset value, and respectively corresponding HTTP network packet and SQL database package Set to be associated to establish the audit data sheet. A correlation auditing method for a network packet and database packet auditing system includes: capturing a plurality of HTTP network packets and a plurality of SQL database packets, and each HTTP network packet includes a global resource addressing information, each SQL data The library package includes a SQL database description; the time for extracting the complex HTTP network packet is divided into complex time intervals, and the number of global resource addressing information distributed in the plurality of intervals is used as a set of global resource addressing information. Statistical sample S(X _i ), and the number of various SQL database statements distributed in the complex time interval as a statistical sample S(Y _i ) of a set of SQL database statements; evaluate and store the two sets of statistical samples The degree of correlation of the quantity distribution in the middle is used as a basis for judging whether the various global information addressing information is related to various SQL database statements; the degree of correlation of the quantity distribution in the two sets of statistical samples stored in the correlation learning analysis program High or low, and the judgment contains whether various global information addressing information is related to the inclusion of various SQL database statements to establish a set of audits. Material table. The correlation auditing method of the network packet and database packet auditing system described in claim 10 evaluates and stores the correlation degree of the quantity distribution in the two sets of statistical samples, and calculates the statistical samples of the two groups at each time. Correlation coefficient of the interval, using the correlation coefficient as a basis for evaluating the correlation between the two sets of statistical samples, and storing the calculated correlation coefficient and the global resource addressing information corresponding to the correlation coefficient and the SQL database statement; The correlation coefficient value determines whether various global resource addressing information is related to various SQL database statements. The method for correlating the network packet and database packet auditing system described in claim 11 is to continuously determine the global resource addressing information when evaluating and storing the degree of correlation of the quantity distribution in the two sets of statistical samples. Whether the various SQL database statements are relevant. The method for correlating the network packet and database packet auditing system according to claim 11 or 12, wherein the global resource addressing information and the SQL database statement are divided into plural time intervals, and the two sets of statistical samples are calculated. The correlation coefficient distributed in each time interval includes the following steps: counting the number of global resource addressing information X _N and its square X _N ² within the current time interval (Tb _N ), and accumulating to a quantity sum And a square sum And then various global resource addressing information and its corresponding number (Tb _N , X _N ), quantity and time in each time interval Square sum And the number of samples taken by the test |X| is stored in an HTTP network packet hash table; the current time interval (Tb _N ) is counted, and the number of the various SQL database statements Y _N and its square Y _N ² are added. To a quantity and And a square sum , then the various SQL database statements and their corresponding to the number of time intervals (Tb _N , Y _N ), quantity and Square sum And the number of samples taken in the |Y| is stored in a hash table of the SQL database; in the current time interval, the number of the global resource addressing information and the number of SQL database envelopes of various SQL database statements are calculated X _N × Y _N and accumulate to a product sum , then the various global resource addressing information, various SQL database statements, the corresponding number of products and the intersection of global resource addressing information and SQL database description samples | X Y | Shuju into a resource for addressing hash table inside; correlation coefficient r is calculated between the various global information addressing information of a statistical sample of S (X _i) with a variety of SQL-owned oblique library Shuju statistical sample S (Y _i), And the number of samples U=|X|+|Y|-|X Y|, and store various global information addressing information, various SQL database statements and corresponding correlation coefficients, and return to the steps of continuously receiving HTTP network packets and SQL database packets. For the association auditing method of the network packet and database packet auditing system described in claim 13, the HTTP network packet hash table includes the address information field, a quantity and a field, a quantity squared field, and the same The number field and the same distribution field, the sample distribution field stores the quantity (Tb _i , X _i ) corresponding to various global resource addressing information in each time interval, and the sample number field stores various global counts. The number of samples taken when the resource addresses the information; and the SQL database package hash table contains a SQL database statement field, a quantity and field, a quantity squared field, the same number field and the same Distribution field, the sample distribution field of the SQL database package hash table stores the number of various SQL database statements distributed in each time interval (Tb _i , Y _i ), and the sample number field of the SQL database package hash table Stores the number of samples taken when counting various SQL database statements. The network packet cum requested item association audit method of claim 14 database audit system of the packet, counting the number of steps currently the world's information within the time interval addressing information of X _i and X _i ² is the square, according to the received first global information system The time interval to which the time of the information is located is set, and the global information addressing information is set to an interval number, and the number X _i and the square X _i ^{2 of} various global resource addressing information in each time number are counted to be added; The step of counting the number Y _i of the SQL database statement and the square Y _i ² in the current time interval is to set the interval number of each SQL database according to the time interval of the time when the SQL database is received. Then, the number Y _i and its square Y _i ^{2 of the} various SQL database statements are counted in the corresponding interval numbers to be added. For the association auditing method of the network packet and database packet auditing system described in claim 15, the system further presets a reserved data threshold, and stores various data in the HTTP network packet hash table and the SQL database hash. After the table, the data with the earliest time interval is deleted according to the reserved data threshold. For the correlation auditing method of the network packet and database packet auditing system described in claim 16, the critical value of the retained data is a time critical value. The value, and the associated learning analysis program deletes all data whose time interval is earlier than the time threshold. The method for correlating the network packet and database packet auditing system according to claim 17, wherein determining whether the global resource addressing information is related to the various SQL database statements comprises the following steps: continuously receiving the HTTP network packet And SQL database package; interpret the global resource addressing information contained in the HTTP network packet and the SQL database description contained in the SQL database package; select the various global resource addressing information for the correlation coefficient of the various SQL database statements higher than one The preset value is associated with the corresponding HTTP network packet and the SQL database package to establish the audit data table. An association auditing apparatus, the correlation auditing apparatus receives a plurality of HTTP network packets and a plurality of database packet, and each of the HTTP network packets includes a global resource addressing information, and each SQL database packet includes a SQL data library a related learning analysis program and an auditing program, wherein: the related learning analysis program receives the complex HTTP network packet and the SQL database packet and receives the same The time of the complex HTTP network packet is divided into complex time intervals, and the number of global resource addressing information distributed in the plurality of intervals is used as a statistical sample S(X _i ) of a set of global resource addressing information, and various SQL data are used. The number of the library statements distributed in the complex time interval is taken as a statistical sample S(Y _i ) of a set of SQL database statements, and the degree of correlation of the quantity distribution in the two sets of statistical samples is evaluated and stored as a judgment The basis for whether global information addressing information is related to various SQL database statements; the auditing process continuously receives multiple HTTP network packets. The SQL database is encapsulated, and according to the degree of correlation of the quantity distribution in the two sets of statistical samples stored in the association learning analysis program, it is judged whether the various global information addressing information is related to the inclusion of various SQL database statements, Establish a set of audit data sheets. The correlation auditing apparatus according to claim 19, wherein the correlation learning analysis program calculates a correlation coefficient of the two sets of statistical samples distributed in each time interval, and uses the correlation coefficient as a basis for evaluating the correlation between the two sets of statistical samples. And storing the calculated correlation coefficient and the correlation coefficient corresponding to the global resource addressing information and the SQL database statement; the auditing program determines the various global resource addressing information and various SQL database statements based on the stored correlation coefficient values Related. The association auditing apparatus according to claim 20 is configured to continuously and simultaneously execute the association learning analysis program when the auditing program is executed. The association auditing apparatus according to claim 20 or 21, wherein the association learning analysis program comprises the steps of: continuously receiving an HTTP network packet and a SQL database packet; and counting various global resources within a current time interval (Tb _N ); The number of addressing information X _N and its square X _N ² , and accumulate to a quantity sum And a square sum And then various global resource addressing information and its corresponding number (Tb _N , X _N ), quantity and time in each time interval Square sum And the number of samples taken by the test |X| is stored in an HTTP network packet hash table; the current time interval (Tb _N ) is counted, and the number of the various SQL database statements Y _N and its square Y _N ² are added. To a quantity and And a square sum , then the various SQL database statements and their corresponding to the number of time intervals (Tb _N , Y _N ), quantity and Square sum And the number of samples taken in the |Y| is stored in a hash table of the SQL database; in the current time interval, the number of the global resource addressing information and the number of SQL database envelopes of various SQL database statements are calculated X _N × Y _N and accumulate to a product sum , then the various global resource addressing information, various SQL database statements, the corresponding number of products and the intersection of global resource addressing information and SQL database description samples | X Y | Shuju into a resource for addressing hash table inside; correlation coefficient r is calculated between the various statistical sample S (X _i) global information addressing information with a variety of SQL databases Shuju statistical sample S (Y _i), And the number of samples U=|X|+|Y|-|X Y|, and store various global information addressing information, various SQL database statements and corresponding correlation coefficients, and return to the steps of continuously receiving HTTP network packets and SQL database packets. The association auditing device according to claim 22, wherein the HTTP network packet hash table includes an address information field, a quantity and a field, a quantity squared field, a same number field, and the same distribution field. The sample distribution field stores the number (Tb _i , X _i ) corresponding to various global resource addressing information in each time interval, and the sample number field stores the number of samples taken when counting various global resource addressing information. And the SQL database package hash table includes a SQL database statement field, a quantity and field, a quantity squared field, the same number field and the same distribution field, SQL database package hash table The sample distribution field stores the number of various SQL database statements distributed in each time interval (Tb _i , Y _i ), and the sample number field of the SQL database package hash table stores the counts of various SQL database statements. The number of samples taken. The correlation auditing device of claim 23, the step of counting the quantity X _i of the global information addressing information in the current time interval and its square X _i ² is based on the time interval to which the time at which the global information is addressed is received. Set each global information addressing information to an interval number, and then count the number of global resource addressing information X _i and its square X _i ^{2 in} each time number to add up; and count the current time interval in the SQL database statement The step of the quantity Y _i and its square Y _i ² is firstly set according to the time interval to which the time in which the SQL database is received, and the interval number of each SQL database is set, and then counted corresponding to each interval number, and various The SQL database describes the number Y _i and its square Y _i ² for summation. The association auditing device of claim 24, wherein the association learning analysis program presets a reserved data threshold, and after storing the various data in the HTTP network packet hash table and the SQL database hash table, according to the Keep the data threshold and delete the oldest data in the time zone. The correlation auditing apparatus according to claim 25, wherein the threshold value of the reserved data is set to a time critical value, and the association learning analysis program All data with a time interval earlier than the time threshold is deleted. The correlation auditing device of claim 26, the auditing program comprises the steps of: continuously receiving an HTTP network packet and a SQL database packet; and interpreting the global resource addressing information and the SQL database packet included in the HTTP network packet. The SQL database description sentence; select various global resource addressing information for the correlation coefficient of various SQL database statements is higher than a preset value, and the corresponding HTTP network packet is associated with the SQL database package. To establish the audit information sheet.