Dynamically determining a trust level of an end-to-end link

Patent metadata

Field	Value
Publication number	US-11297105-B2
Application number	US-202016935278-A
Country	US
Kind code	B2
Filing date	Jul 22, 2020
Priority date	Jul 22, 2020
Publication date	Apr 5, 2022
Grant date	Apr 5, 2022

Abstract

A system and method for dynamically determining a trust level of an end-to-end link of a computer database, including: in a preparation stage: capturing a first set of messages of an end-to-end link; compressing a skeleton of each message of the first set of messages to generate a construct of each message of the first set of messages, the skeleton includes the message without a value field; creating a characteristic histogram of the constructs of the first set of messages; and during an operation stage: capturing a second set of messages of the end-to-end link; compressing a skeleton of each message of the second set of messages to generate a construct of each of the second set of messages; creating a work histogram of the constructs of the second set of messages; and determining a trust level of the end-to-end link by comparing the work histogram with the characteristic histogram.

First claim

The invention claimed is:

1. A method for dynamically determining a trust level of an end-to-end link of a computer database, the method comprising:
in a preparation stage:
capturing a first set of messages of a first end-to-end link;
compressing a skeleton of each message of the first set of messages to generate a construct of each message of the first set of messages, wherein the skeleton comprises the message without a value field;
creating a characteristic histogram of the constructs of the first set of messages;
obtaining a plurality of sets of messages, wherein each set pertains to an end-to-end link of a set of end-to-end links;
generating a construct of each message of the plurality of sets of messages;
creating a characteristic histogram for each end-to-end link of the set of end-to-end links, wherein each characteristic histogram is created from the constructs of a set of messages of an end-to-end link of the set of end-to-end links; and
performing clustering of the characteristic histograms to determine clusters of end-to-end links; and

during an operation stage:
capturing a second set of messages of the first end-to-end link;
compressing a skeleton of each message of the second set of messages to generate a construct of each of the second set of messages;
creating a work histogram of the constructs of the second set of messages; and
determining a trust level of the first end-to-end link by comparing the work histogram with the characteristic histogram, and with each of the characteristic histograms of a cluster of the first end-to-end link.

2. The method of claim 1 , wherein an end-to-end link is defined according to parameters of the end-to-end link, wherein the parameters are selected from the list consisting of: host name, service name, database name, client host name, operating system user and database user.

3. The method of claim 1 , wherein determining the trust level of the end-to-end link comprises determining the trust level of the end-to-end link as not trusted if at least one of the constructs of the second set of messages is not included in the characteristic histogram of the constructs of the first set of messages.

4. The method of claim 1 , wherein compressing a skeleton comprises hashing the skeleton.

5. The method of claim 1 , comprising:
in the preparation stage:
adding the commands of the first set of messages divided into command groups to the characteristic histogram; and

during the operation stage:
adding the commands of the second set of messages divided into the command groups to the work histogram.

6. The method of claim 1 , wherein capturing a second set of messages is repeated for every new session and periodically.

7. The method of claim 1 , wherein the trust level is selected from trusted and not trusted, the method comprising:
not performing comprehensive security analysis for future messages of the end-to-end link if the trust level is trusted; and
applying policy rules to future messages of the end-to-end link if the trust level is not trusted.

8. The method of claim 1 , comprising:
adding the construct of each of the second set of messages to the characteristic histogram if the trust level is trusted.

9. The method of claim 1 , wherein the work histogram is compared with the characteristic histogram by comparing the variance of the work histogram with the variance of the characteristic histogram.

10. A system for dynamically determining a trust level of an end-to-end link, the system comprising:
a memory; and
a processor configured to:
in a preparation stage:
obtain a first set of messages of a first end-to-end link;
compress a skeleton of each message of the first set of messages to generate a construct of each message of the first set of messages, wherein the skeleton comprises the message without a value field;
create a characteristic histogram of the constructs of the first set of messages; obtain a plurality of sets of messages, wherein each set pertains to an end-to-end link of a set of end-to-end links;
generate a construct of each message of the plurality of sets of messages;
create a characteristic histogram for each end-to-end link of the set of end-to-end links, wherein each characteristic histogram is created from the constructs of a set of messages of an end-to-end link of the set of end-to-end links; and
perform clustering of the characteristic histograms to determine clusters of end-to-end links; and

during an operation stage:
obtain a second set of messages of the first end-to-end link;
compress a skeleton of each message of the second set of messages to generate a construct of each of the second set of messages;
create a work histogram of the constructs of the second set of messages; and
determine a trust level of the first end-to-end link by comparing the work histogram with the characteristic histogram and with each of the characteristic histograms of a cluster of the first end-to-end link.

11. The system of claim 10 , wherein the processor is configured to define an end-to-end link according to parameters of the end-to-end link, wherein the parameters are selected from the list consisting of: host name, service name, database name, client host name, operating system user and database user.

12. The system of claim 10 , wherein the processor is configured to determine the trust level of the end-to-end link by determining the trust level of the end-to-end link to be not trusted if at least one of the constructs of the second set of messages is not included in the characteristic histogram of the constructs of the first set of messages.

13. The system of claim 10 , wherein the processor is configured to compress a skeleton by hashing the skeleton.

14. The system of claim 10 , wherein the processor is configured to:
in the preparation stage:
add the commands of the first set of messages divided into command groups to the characteristic histogram; and

during the operation stage:
add the commands of the second set of messages divided into the command groups to the work histogram.

15. The system of claim 10 , wherein the processor is configured to repeat capturing a second set of messages every new session and periodically.

16. The system of claim 10 , wherein the trust level is selected from trusted and not trusted, wherein the processor is configured to:
not perform comprehensive security analysis for future messages of the end-to-end link if the trust level is trusted; and
apply policy rules to future messages of the end-to-end link if the trust level is not trusted.

17. The system of claim 10 , wherein the processor is configured to:
add the construct of each of the second set of messages to the characteristic histogram if the trust level is trusted.

18. The system of claim 10 , wherein the processor is configured to compare the work histogram with the characteristic histogram by comparing the variance of the work histogram with the variance of the characteristic histogram.

Assignees

• IBM

Inventors

• Sofer Oded

Classifications

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/166 Primary

  at the transport layer · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title