System and method for tracking and auditing data access in a network environment
A system and method that correlate business transaction in a system and traffic generated from this business transaction in a network back to a user identity that invoked this business transaction and generated subsequent network traffic. The method enables a user to set up rules for tracking the activities in a system and network traffic and these rules can then be user later for monitoring user activities. The user activities, network traffic, and the user identity are correlated and stored in a data-to-business mapping file. This data-to-business mapping file can be used for auditing events in the system.
1. A method for tracking user activities in a network system, comprising the steps of:
detecting, by a tracking server at an entry point in the network system, a request from a user;
retrieving, by the tracking server from a storage unit, a rule based on the entry point and the request;
tracking, by the tracking server, user access information associated with the request according to the rule;
tracking, by the tracking server, a connection identification between servers associated with the request;
recording the user access information and the connection identification in a data-to-business mapping file; and
creating a timer for a session identification, wherein when the timer expires the data-to-business mapping file is closed and a new data-to-business mapping file created.
2. The method of claim 1 , further comprising the step of creating the session identification associated with the user identification for the user.
3. The method of claim 1 , further comprising the steps of:
determining whether there is a session identification associated with the user identification; and
creating a session identification for the user identification if there is no session identification associated with the user identification.
4. The method of claim 1 , wherein the tracking step further comprising the step of monitoring database access requests and database responses in the network system.
5. The method of claim 1 , wherein the tracking the user access information step further comprising the step of obtaining identification information for activities generated from the request.
6. The method of claim 1 , wherein the user access information comprises user login identification and the session identification.
7. The method of claim 1 , wherein the step of detecting, by a tracking server at an entry point, a request from a user further comprises
detecting a business operation invoked by the user at the entry point; and
generating the request corresponding to the business operation.
8. A server for tracking user activities in a network system, comprising:
a network interface unit for monitoring network traffic;
an audit policy unit for controlling rules;
a database tracking unit for database access requests and responses;
a control unit; and a
storage unit in which a non-transitory computer program is stored, wherein when the non-transitory computer program is executed by the control unit, the server performs the steps of:
detecting, at an entry point, a request from a user,
retrieving a rule associated with the request and the entry point,
tracking user access information associated with the request according to the rule,
tracking a connection identification between servers in the network system associated with the request,
recording the user access information and the connection identification in a data-to-business mapping file; and
creating a timer for a session identification, wherein when the timer expires the data-to-business mapping file is closed and a new data-to-business mapping file created.
9. The server of claim 8 , wherein the server further performs the step of creating the session identification associated with an user identification for the user.
10. The server of claim 8 , wherein the server further performs the steps of:
determining whether there is a session identification associated with an user identification for the user; and
creating a session identification for the user identification if there is no session identification associated with the user identification.
11. The server of claim 8 , wherein the tracking user access information step further comprising the step of monitoring database access requests and database responses in the network system.
12. The server of claim 8 , wherein the request is a business transaction invoked by the user.
13. The server of claim 8 , wherein the tracking user access information step further comprising the step of obtaining identification information for activities generated from the request.
14. The server of claim 8 , wherein the user access information comprises user login identification and the session identification.