Detecting attacks on databases based on transaction characteristics determined from analyzing database logs

Patent metadata

Field	Value
Publication number	US-10803192-B2
Application number	US-201815995123-A
Country	US
Kind code	B2
Filing date	May 31, 2018
Priority date	Apr 8, 2018
Publication date	Oct 13, 2020
Grant date	Oct 13, 2020

Abstract

A method by a security system implemented by one or more electronic for detecting attacks on one or more databases. The method includes analyzing database logs of one or more databases to determine transaction characteristics of each of the one or more databases, selecting, for each of a plurality of database accesses to the one or more databases, one or more security rules to apply to that database access, wherein different security rules are selected for different ones of the plurality of database accesses depending on the determined transaction characteristics of the database being accessed, and causing, for each of the plurality of database accesses, the one or more security rules selected for that database access to be applied to that database access.

First claim

The invention claimed is:

1. A method by a security system implemented by one or more electronic for detecting attacks on one or more databases, the method comprising:
analyzing database logs of one or more databases to determine transaction characteristics of each of the one or more databases, wherein the determined transaction characteristics of each of the one or more databases include whether the number of new interactive users accessing each of the one or more databases converges over time;
selecting, for each of a plurality of database accesses to the one or more databases, one or more security rules to apply to that database access, wherein different security rules are selected for different ones of the plurality of database accesses depending on the determined transaction characteristics of the database being accessed; and
causing, for each of the plurality of database accesses, the one or more security rules selected for that database access to be applied to that database access.

2. The method of claim 1 , wherein a first security rule is selected for database accesses that access a database for which it has been determined that the number of new interactive users accessing the database converges over time, wherein a second security rule is selected for database accesses that access a database for which it has been determined that the number of new interactive users accessing the database does not converge over time, wherein the first security rule is a rule to generate an alert every time an interactive user accesses an application database object and the second security rule is a rule to not generate an alert when an interactive user accesses an application database object.

3. The method of claim 1 , wherein the determined transaction characteristics of each of the one or more databases further include whether the number of new application database objects accessed by interactive users in each of the one or more databases converges over time.

4. The method of claim 3 , wherein a first security rule is selected for database accesses that access a database for which it has been determined that the number of new interactive users accessing the database converges over time and the number of new application database objects accessed by interactive users in the database converges over time, wherein a second security rule is selected for database accesses that access a database for which it has been determined that the number of new interactive users accessing the database converges over time and the number of new application database objects accessed by interactive users in the database does not converge over time, wherein a third security rule is selected for database accesses that access a database for which it has been determined that the number of new interactive users accessing the database does not converge over time and the number of new application database objects accessed by interactive users in the database converges over time, wherein a fourth security rule is selected for database accesses that access a database for which it has been determined that the number of new interactive users accessing the database does not converge over time and the number of new application database objects accessed by interactive users in the database does not converge over time, and wherein the first security rule is a rule to generate an alert every time an interactive user accesses an application database object, the second security rule is a rule to generate an alert only the first time a given database object is accessed by an interactive user, the third security rule is a rule to generate an alert only the first time a given interactive user accesses an application database object, and the fourth security rule is a rule to not generate an alert when an interactive user accesses an application database object.

5. A method by a security system implemented by one or more electronic for detecting attacks on one or more databases, the method comprising:
analyzing database logs of one or more databases to determine transaction characteristics of each of the one or more databases, wherein the determined transaction characteristics of each of the one or more databases include a database type of each of the one or more databases, wherein the database type is one of an Online Transaction Processing Type (OLTP) type database and an Online Analytical Processing (OLAP) type database;
selecting, for each of a plurality of database accesses to the one or more databases, one or more security rules to apply to that database access, wherein different security rules are selected for different ones of the plurality of database accesses depending on the determined transaction characteristics of the database being accessed; and
causing, for each of the plurality of database accesses, the one or more security rules selected for that database access to be applied to that database access.

6. The method of claim 5 , wherein the database logs are analyzed using a database classification model that has been trained using machine learning to classify each of the one or more databases as being an OLTP type database or an OLAP type database.

7. The method of claim 6 , wherein the database classification model classifies each of the one or more database as being an OLTP type database or an OLAP type database based on one or more of access tool distribution, query operation distribution, distribution of the number of operations per user, distribution of query response times, distribution of user types, user concurrency distribution, and textual hints.

8. The method of claim 5 , wherein a first security rule is selected for database accesses that access a database determined to be an OLTP type database, wherein a second security rule is selected for database accesses that access a database determined to be an OLAP type database, and wherein the first security rule is a rule to generate an alert when an interactive user accesses an application database object and the second security rule is a rule to not generate an alert when an interactive user accesses an application database object.

9. A set of one or more non-transitory computer readable storage media storing instructions which, when executed by one or more processors of one or more computing devices, cause the one or more computing devices to perform operations for detecting attacks on one or more databases, the operations comprising:
analyzing database logs of one or more databases to determine transaction characteristics of each of the one or more databases, wherein the determined transaction characteristics of each of the one or more databases include whether the number of new interactive users accessing each of the one or more databases converges over time;
selecting, for each of a plurality of database accesses to the one or more databases, one or more security rules to apply to that database access, wherein different security rules are selected for different ones of the plurality of database accesses depending on the determined transaction characteristics of the database being accessed; and
causing, for each of the plurality of database accesses, the one or more security rules selected for that database access to be applied to that database access.

10. The set of one or more non-transitory computer readable storage media of claim 9 , wherein a first security rule is selected for database accesses that access a database for which it has been determined that the number of new interactive users accessing the database converges over time, wherein a second security rule is selected for database accesses that access a database for which it has been determined that the number of new interactive users accessi

Assignees

• Imperva Inc

Inventors

• Margel Shiri
• Mantin Itsik
• Shtar Guy
• Geiler Yury

Classifications

• G06F21/554

  involving event detection and direct action · CPC title

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title