关键词: 数据库安全审计, 旁路监听, 透明网络底层（TNS）协议, 结构化查询语言（SQL）语法解析, 安全检测

Abstract: By analyzing the database security audit mechanism, a type of database security audit system framework based on bypass monitoring is proposed and a system aiming at Oracle database is completed under the framework. This paper refers to the technology realization of network packet capture based on Java, TNS protocol analysis, SQL parsing and database security detection. An anomaly detection algorithm which can discover user’s normal behavior is also proposed. The experimental result shows that this system can audit Oracle database effectively in real time and can analyze the security of database operation.

Key words: database security audit, bypass monitoring, Transparent Network Substrate（TNS） protocol, Structured Query Language（SQL） parse, security detection