Unauthorized data access detection based on cyber security images

Patent metadata

Field	Value
Publication number	US-10708282-B2
Application number	US-201715469985-A
Country	US
Kind code	B2
Filing date	Mar 27, 2017
Priority date	Mar 27, 2017
Publication date	Jul 7, 2020
Grant date	Jul 7, 2020

Abstract

In some examples, a system for detecting unauthorized data access can include a processor to detect a suspicious operation to be executed by the system and review a plurality of highlights corresponding to the suspicious operation. The processor can also determine that a predefined cyber security image corresponding to the highlights and the suspicious operation does not exist and generate the predefined cyber security image based on a plurality of sub-cyber security images. Furthermore, the processor can store the predefined cyber security image in a cyber security image repository and prevent the suspicious operation from being executed.

First claim

What is claimed is:

1. A system for detecting unauthorized access of data comprising:
a hardware processor to:
detect a suspicious operation to be executed by the system;
review a plurality of highlights corresponding to the suspicious operation;
determine that a predefined cyber security image corresponding to the plurality of highlights and the suspicious operation does not exist;
generate the predefined cyber security image comprising a plurality of sub-cyber security images based on the plurality of highlights;
store the predefined cyber security image in a cyber security image repository, wherein the predefined cyber security image comprises a server profile indicating a number of records per request corresponding to an unauthorized user accessing a database from a server associated with the server profile;
prevent the suspicious operation from being executed; and
prevent a second suspicious operation from being executed in response to detecting the second suspicious operation matches the predefined cyber security image.

2. The system of claim 1 , wherein the hardware processor is to:
detect a second suspicious operation to be executed by the system;
review a second plurality of highlights corresponding to the second suspicious operation;
determine that a second predefined cyber security image corresponding to the second plurality of highlights and the second suspicious operation exists in the cyber security image repository; and
prevent the second suspicious operation from being executed in response to detecting the second suspicious operation matches the second predefined cyber security image.

3. The system of claim 1 , wherein the predefined cyber security image further comprises a user profile, an activities data set, an error data set, and a violation data set.

4. The system of claim 3 , wherein the server profile comprises a number of requests during a period of time, a number of data source instances, a number of database users, a number of operating system users, a number of objects accessed, a number of commands, a response time per request, a list of active hours, a peak hour, or any combination thereof.

5. The system of claim 3 , wherein the user profile comprises a number of requests during a period of time, a number of accessed data sources, a number of clients, a number of objects accessed, a number of commands, a number of records per request, a response time per request, a list of active hours, or any combination thereof.

6. The system of claim 3 , wherein the activities data set comprises a number of activities during a period of time, a number of objects per activity, a number of commands, a number of records per request, a response time per request, a list of active hours, a peak hour, or any combination thereof.

7. The system of claim 3 , wherein the error data set comprises a list of error types, a number of errors per period of time, a number of users with errors, a frequency of errors, or any combination thereof.

8. The system of claim 3 , wherein the violation data set comprises a list of violation types, a number of violations per period of time, a number of users with at least one violation, a frequency of violation, or any combination thereof.

9. A method for detecting unauthorized data access comprising:
detecting, via a hardware processor, a suspicious operation to be executed by the system;
reviewing, via the hardware processor, a plurality of highlights corresponding to the suspicious operation;
determining, via the hardware processor, that a predefined cyber security image corresponding to the highlights and the suspicious operation exists;
generating, via the hardware processor, the predefined cyber security image based on a plurality of sub-cyber security images;
storing, via the hardware processor, the predefined cyber security image in a cyber security image repository, wherein the predefined cyber security image comprises a server profile indicating a number of records per request corresponding to an unauthorized user accessing a database from a server associated with the server profile;
preventing, via the hardware processor, the suspicious operation from being executed; and
prevent a second suspicious operation from being executed in response to detecting the second suspicious operation matches the predefined cyber security image.

10. The method of claim 9 , comprising:
detecting, via the hardware processor, a second suspicious operation to be executed by the system;
reviewing, via the hardware processor, a second plurality of highlights corresponding to the second suspicious operation;
determining, via the hardware processor, that a second predefined cyber security image corresponding to the second plurality of highlights and the second suspicious operation exists in the cyber security image repository; and
preventing, via the hardware processor, the second suspicious operation from being executed in response to detecting the second suspicious operation matches the second predefined cyber security image.

11. The method of claim 9 , wherein the predefined cyber security image further comprises a user profile, an activities data set, an error data set, and a violation data set.

12. The method of claim 11 , wherein the server profile comprises a number of requests during a period of time, a number of data source instances, a number of database users, a number of operating system users, a number of objects accessed, a number of commands, a response time per request, a list of active hours, a peak hour, or any combination thereof.

13. The method of claim 11 , wherein the user profile comprises a number of requests during a period of time, a number of accessed data sources, a number of clients, a number of objects accessed, a number of commands, a number of records per request, a response time per request, a list of active hours, or any combination thereof.

14. The method of claim 11 , wherein the activities data set comprises a number of activities during a period of time, a number of objects per activity, a number of commands, a number of records per request, a response time per request, a list of active hours, a peak hour, or any combination thereof.

15. The method of claim 11 , wherein the error data set comprises a list of error types, a number of errors per period of time, a number of users with errors, a frequency of errors, or any combination thereof.

16. The method of claim 11 , wherein the violation data set comprises a list of violation types, a number of violations per period of time, a number of users with at least one violation, a frequency of violation, or any combination thereof.

17. A computer program product for detecting unauthorized data access, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, wherein the computer readable storage medium is not a transitory signal per se, the program instructions executable by a processor to cause the processor to:
detect a suspicious operation to be executed by the system;
review a plurality of highlights corresponding to the suspicious operation;
determine that a predefined cyber security image corresponding to the highlights and the suspicious operation does not exist;
generate the predefined cyber security image based on a plurality of sub-cyber security images;
store the predefined cyber security image in a cyber security image repository, wherein the predefined cyber security image comprises a server profile indicating a number of records per request corresponding to an unauthori

Assignees

• IBM

Inventors

• Biller Ofer
• Miroshnikov Rosa
• Rozenblat David
• Sofer Oded

Classifications

• H04L67/75

  Indicating network or usage conditions on the user display · CPC title

• H04L63/102

  Entity profiles · CPC title

• H04L67/04

  specially adapted for terminals or networks with limited capabilities; specially adapted for terminal portability · CPC title

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title

• H04L63/10

  for controlling access to devices or network resources · CPC title