Dynamically determining trust level of end-to-end link

Abstract

A system and method for dynamically determining a trust level of an end-to-end link of a computer database includes, in a preparation phase: capturing a first set of messages of the end-to-end link; compressing a framework of each message in the first set of messages to generate a construct of each message in the first set of messages, the framework including messages without a value field; creating a feature histogram of the constructs of the first set of messages; during an operational phase: capturing a second set of messages of the end-to-end link; compressing a framework of each message in the second set of messages to generate a construct of each message in the second set of messages; creating a working histogram of the constructs of the second set of messages; and determining the trust level of the end-to-end link by comparing the working histogram to the feature histogram.

Description

Technical Field

[0001] This invention generally relates to dynamic whitelists, and more particularly to dynamically determining the trust level of an end-to-end link from a user to a computer database. Background Technology

[0002] Data firewalls typically capture or sniff data access to databases in real time (e.g., requests and responses) and analyze the data according to policy rules. A data firewall may include a Data Activity Monitor (DAM) and / or a File Activity Monitor (FAM). Requests and responses sniffed by the data firewall may include requests (e.g., Structured Query Language (SQL) statements) or responses, along with associated header information. Headers may include metadata such as machine information, network information, user information, client information, etc.

[0003] The standard solution for DAM is to install an agent on the data source server (e.g., a database server). The agent can capture, mirror, or sniff requests and responses and forward them to a security server. The security server can then parse the data, enforce policies, and then audit, analyze, warn, or block requests and responses as needed. One of the main challenges of DAM is the need to capture and analyze massive amounts of data. For example, in a typical enterprise environment, DAM can capture or sniff approximately 100 million transactions per second (e.g., requests and responses) (TPS). Sniffing and analyzing such large volumes of data in real-time or near real-time requires appropriate computing infrastructure that can be very expensive.

[0004] Therefore, a method is needed to reduce the amount of data to be analyzed. Summary of the Invention

[0005] According to embodiments of the present invention, a system and method for dynamically determining the trust level of an end-to-end link in a computer database may include: in a preparation phase: capturing a first set of messages for the first end-to-end link; compressing a skeleton frame of each message in the first set of messages to generate a construct of each message in the first set of messages, wherein the skeleton includes messages without value fields; and creating a feature histogram of the construct of the first set of messages; during an operation phase: capturing a second set of messages for the first end-to-end link; compressing a skeleton frame of each message in the second set of messages to generate a construct of each message in the second set of messages; creating a working histogram of the construct of the second set of messages; and determining the trust level of the first end-to-end link by comparing the working histogram with the feature histogram.

[0006] According to embodiments of the present invention, an end-to-end link can be defined based on parameters of the end-to-end link, wherein the parameters are selected from: host name, service name, database name, client host name, operating system user, and database user.

[0007] According to an embodiment of the present invention, determining the trust level of an end-to-end link may include: if at least one construct in the construction of the second message set is not included in the feature histogram of the construction of the first message set, then the trust level of the end-to-end link is determined to be untrusted.

[0008] According to embodiments of the present invention, compressing a frame may include hashing the frame to generate a hash.

[0009] Embodiments of the present invention may include: adding commands from a first set of messages, which will be divided into command groups, to a feature histogram during the preparation phase; and adding commands from a second set of messages, which will be divided into command groups, to a working histogram during the operation phase.

[0010] Embodiments of the present invention may include: in a preparation phase, obtaining a plurality of message sets, wherein each set relates to an end-to-end link in an end-to-end link set; generating a construction for each message in the plurality of message sets; creating a feature histogram for each end-to-end link in the end-to-end link set, wherein each feature histogram is created from the construction of the message set of the end-to-end links in the end-to-end link set; and performing clustering of the feature histograms to determine the clustering of the end-to-end links; and during operation, comparing the working histogram with each feature histogram of the clustering of the first end-to-end links to determine the trust level of the first end-to-end link.

[0011] According to embodiments of the present invention, a second set of messages can be captured repeatedly for each new session and periodically.

[0012] According to embodiments of the present invention, the trust level can be selected as trusted and untrusted, and embodiments of the present invention may include: if the trust level is trusted, then not performing comprehensive security analysis on future messages of the end-to-end link; and if the trust level is untrusted, then applying policy rules to future messages of the end-to-end link.

[0013] Embodiments of the present invention may include adding the construction of each message in the second message set to the feature histogram if the trust level is trusted.

[0014] According to an embodiment of the present invention, the working histogram can be compared with the characteristic histogram by comparing the variance of the working histogram with the variance of the characteristic histogram. Attached Figure Description

[0015] The subject matter of the invention is specifically pointed out and clearly claimed in the conclusion section of the specification. However, the organization and operation of embodiments of the invention, as well as its objects, features, and advantages, can be best understood by referring to the following detailed description when read in conjunction with the accompanying drawings. Embodiments of the invention are illustrated by way of example and are not limited to the figures in the drawings, in which the same reference numerals denote corresponding, similar, or analogous elements, and wherein:

[0016] Figure 1 A cloud computing environment according to an embodiment of the present invention is described;

[0017] Figure 2 An abstract model layer according to an embodiment of the present invention is described;

[0018] Figure 3 A system according to an embodiment of the present invention is described;

[0019] Figure 4A An example of a data source machine including a database server is depicted according to an embodiment of the present invention;

[0020] Figure 4B A data source machine comprising a combination of a gateway, network gateway or proxy and a database server is described according to embodiments of the present invention;

[0021] Figure 5 Histograms depicting messages, frames, structures, and features of an end-to-end link according to embodiments of the present invention are provided.

[0022] Figure 6A A comparison of the working histogram and the characteristic histogram of an end-to-end link according to an embodiment of the present invention is depicted.

[0023] Figure 6B A comparison is depicted between the working histogram of an end-to-end link according to an embodiment of the present invention and multiple feature histograms of multiple end-to-end links, each feature histogram relating to the clustering of the end-to-end links;

[0024] Figure 6C A comparison is depicted between the working histogram of the end-to-end link and the common feature histogram of the clustering of the end-to-end link according to an embodiment of the present invention;

[0025] Figure 7 This is a flowchart of a method for associating messages with an end-to-end link according to an embodiment of the present invention;

[0026] Figure 8 This is a flowchart of a method for generating feature histograms according to an embodiment of the present invention.

[0027] Figure 9This is a flowchart of a method for dynamically determining the trust level of an end-to-end link in a computer database according to an embodiment of the present invention; and

[0028] Figure 10 An example computing device according to an embodiment of the present invention is shown.

[0029] It should be understood that, for the sake of simplicity and clarity, the elements shown in the figures are not necessarily drawn to scale. For example, for clarity, the dimensions of some elements may be enlarged relative to others. Furthermore, where deemed appropriate, reference numerals may be repeated in the figures to indicate corresponding or similar elements. Detailed Implementation

[0030] In the following description, various aspects of the invention will be described. Specific configurations and details are set forth for purposes of explanation in order to provide a thorough understanding of the invention. However, it will be apparent to those skilled in the art that the invention may be practiced without the specific details set forth herein. Furthermore, well-known features may be omitted or simplified so as not to obscure the invention.

[0031] While some embodiments of the invention are not limited thereto, discussions using terms such as “processing,” “computing,” “operation,” “determining,” “establishing,” “analyzing,” and “checking” can refer to one or more operations and / or processes of a computer, computing platform, computing system, or other electronic computing device that manipulates and / or transforms data representing physical (e.g., electronic) quantities in the registers and / or memory of a computer into other information, transient or non-transient, or other data representing physical quantities in a processor-readable storage medium, which, when executed by a processor, causes the processor to perform operations and / or processes. While embodiments of the invention are not limited thereto, the terms “multiple” and “a plurality” as used herein can include, for example, “multiple” or “two or more.” The terms “multiple” or “a plurality” may be used throughout the specification to describe two or more components, devices, elements, units, parameters, etc. Unless otherwise stated, the term “set” as used herein may include one or more items. Unless explicitly stated otherwise, the method embodiments described herein are not limited to a particular order or sequence. In addition, some of the described method embodiments or elements thereof may occur or be executed simultaneously, at the same point in time, or concurrently with a different order than that described.

[0032] It should be understood that although this disclosure includes a detailed description of cloud computing, the implementation of the teachings set forth herein is not limited to a cloud computing environment. Rather, embodiments of the invention can be implemented in conjunction with any other type of computing environment now known or developed hereafter.

[0033] Cloud computing is a service delivery model that enables convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing power, storage, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal management costs or interaction with service providers. This cloud model may include at least five features, at least three service models, and at least four deployment models.

[0034] Features can be, for example:

[0035] On-demand self-service: Cloud consumers can unilaterally and automatically provide computing power (such as server time and network storage) on demand without human interaction with the service provider.

[0036] Wide network access: Capabilities are available on the network and accessed through standard mechanisms that facilitate the use of heterogeneous thin or thick client platforms, such as mobile phones, laptops, and PDAs.

[0037] Resource pooling: A provider's computing resources are grouped into resource pools to serve multiple consumers using a multi-tenant model, where different physical and virtual resources are dynamically allocated and reallocated based on demand. Generally, consumers cannot control or know the exact location of the resources provided, but can specify the location at a higher level of abstraction (e.g., country, state, or data center), thus exhibiting location independence.

[0038] Rapid and flexible: Capabilities can be rapidly and flexibly (in some cases automatically) provided to expand outward quickly and be rapidly released to shrink back down. For consumers, the available capacity often appears unlimited and can be purchased in any quantity at any time.

[0039] Measurable services: Cloud systems automatically control and optimize resource usage by leveraging metering capabilities at a level of abstraction appropriate to the service type (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both service providers and consumers.

[0040] The service model can be, for example:

[0041] Software as a Service (SaaS): This provides consumers with the ability to use applications running on a provider's cloud infrastructure. These applications can be accessed from various client devices via thin client interfaces such as web browsers (e.g., web-based email). Aside from limited user-specific application configuration settings, consumers neither manage nor control the underlying cloud infrastructure, including the network, servers, operating system, storage, or even individual application capabilities.

[0042] Platform as a Service (PaaS): This provides consumers with the ability to deploy consumer-created or acquired applications on cloud infrastructure using programming languages ​​and tools supported by the provider. Consumers neither manage nor control the underlying cloud infrastructure, including networks, servers, operating systems, or storage, but they have control over the applications they deploy and may also have control over the configuration of the application hosting environment.

[0043] Infrastructure as a Service (IaaS): This provides consumers with the capability to deploy and run any software, including operating systems and applications, on the cloud, providing them with processing, storage, networking, and other basic computing resources. Consumers neither manage nor control the underlying cloud infrastructure, but they have control over the operating system, storage, and deployed applications, and may have limited control over chosen network components (e.g., host firewalls).

[0044] Database as a Service (DBaaS): This provides consumers with the ability to store data on cloud infrastructure. The DBaaS paradigm is a common approach to storing data in cloud-based computerized services, where users can access the data without needing to manage hardware or software.

[0045] The deployment model can be, for example:

[0046] Private cloud: A cloud infrastructure that operates exclusively for a single organization. It can be managed by that organization or a third party, and can exist inside or outside the organization.

[0047] Community cloud: A cloud infrastructure shared by several organizations that supports a specific community with common interests (e.g., mission, security requirements, policy and compliance considerations). It can be managed by the organization or a third party and can exist inside or outside the organization.

[0048] Public cloud: Cloud infrastructure available to the general public or large industrial groups and owned by organizations that sell cloud services.

[0049] Hybrid cloud: A cloud infrastructure consisting of two or more clouds (private, community, or public) that remain distinct entities but are bound together by standardized or proprietary technologies that enable data and applications to be ported together (e.g., cloud bursts for load balancing between clouds).

[0050] Cloud computing environments are service-oriented, characterized by statelessness, loose coupling, modularity, and semantic interoperability. The core of computing is the infrastructure comprising a network of interconnected nodes.

[0051] Embodiments of the present invention can provide a system and method for dynamic whitelisting or for dynamically determining the trust level of a connection to a computer database. According to embodiments of the present invention, messages associated with a trusted end-to-end link (e.g., the body or payload of a database request and response) may not undergo comprehensive security analysis.

[0052] The current architecture of DAM and FAM products is based on a two-step process. The first step is performed in real time by agent software or an application installed on the data source machine, and the second step is performed offline by a security server application (also known as a collector). The data source machine can include a database, such as a database server, file server, etc., or a combination of a database and a database agent or gateway. The agent software can be installed on the database itself or on the database agent or gateway. Installing agent software on the database agent or gateway enables the capture of data packets (also known as data records) (when using the DBaaS model) in cloud-based databases that have been manipulated multiple times by third parties who are not permitted to install software applications on their databases.

[0053] Based on existing technology, the agent application can capture or receive all data packets, including requests and responses from the monitored database, read header information, perform initial rule processing on the header information, and then send the data packets to the collector application for offline comprehensive security analysis. The comprehensive security analysis performed by the collector can include: obtaining or receiving data packets from the agent, parsing the data packets, constructing data (e.g., classifying data and mapping metadata to data), establishing data hierarchies, applying policy rules to the classified data to identify sensitive data, and detecting data corruption or tampering based on rule matching. Afterward, the collector can send the data for further analysis and auditing by other components.

[0054] Many processes in comprehensive security analysis performed by the collector rely on the mapping and classification of data. Due to the complexity and performance requirements of mapping and classifying massive amounts of data (e.g., 100,000 TPS per data source or 100 million TPS in total), this is typically done offline. The agent must not delay transactions and must avoid latency. Sniffing and analyzing such large volumes of data in real-time or near real-time requires appropriate computing infrastructure that can be very expensive.

[0055] One approach to reduce the amount of data to be analyzed is through whitelisting. Whitelisting may include: determining the trust level or other rating of end-to-end links for which comprehensive security analysis is not performed on requests and responses to trusted end-to-end links, and performing comprehensive security analysis on requests and responses to untrusted end-to-end links.

[0056] Existing solutions for whitelisting may include using techniques such as User Behavior Analytics (UBA), risk assessment, signature search, and trusted connections to mark or label end-to-end links as trusted or untrusted. However, all of these techniques are static; for example, once a connection is classified as trusted, all traffic within that connection is considered trusted. Therefore, these techniques are vulnerable to attacks such as hijacking, where an attacker takes over a portion of the connection and acts as one of the participants.

[0057] Embodiments of the present invention can improve security analysis techniques by providing a method for whitelisting or determining the trust level or rating of end-to-end links that is both dynamic (e.g., executed periodically at runtime) and requires fewer computational resources (compared to a comprehensive analysis of communications). Embodiments of the method for determining the trust level of end-to-end links can be executed periodically, in real-time, or near real-time, and therefore, can enable the detection of anomalous behavior in communications on previously identified trusted end-to-end links. Thus, assuming that the hijacker's behavior may differ from that of a normal user on the end-to-end link, a hijacking attack can be detected, in which the attacker takes over a portion of a previously classified trusted end-to-end link.

[0058] A database connection can be a software architecture that enables client applications or software to communicate with the data source machine, such as sending commands and receiving responses. In many applications, connections are pooled to facilitate connection reuse. Therefore, multiple users can collaboratively use multiple connections. According to embodiments of the invention, an end-to-end link can represent communication between a single client and a single database. The link can be carried over multiple connections in one or more connection pools.

[0059] According to embodiments of the present invention, an end-to-end link can be defined by a tuple or combination of parameters associated with a request sent to or a response received from a database, specifying the end-to-end link. The tuple may include parameters that associate the request or response with a single user. These parameters can be obtained from the header of the request or response. Ideally, the end-to-end link is unique to a single user, or at least as close as possible to a single user based on available parameters. The parameter tuple may include user information, source code information, and database information. User information may include parameters identifying the user themselves. For example, user information parameters may include one or more of a database user identifier (DB user), an operating system user identifier (OS user), an application user identifier (App user), and a client host address (ClientHost). Source code information may include parameters identifying the application or software used to connect the user to the database, such as SQLplus, Java Database Connectivity (JDBC), etc. Database information may include parameters identifying the database. For example, database information may include one of a database name (DbName) or a service name (ServiceName), and one of a database server host name (ServerHostName) or a database server IP address. Other user information parameters, source program information parameters, database information parameters, or other parameters can be used.

[0060] Using tuples, rather than just database user identifiers (DB users), to specify end-to-end links allows for the definition of a single end-to-end link used by a single user. This is useful in situations where multiple users share the same connection or connection pool, allowing for the detection of a single user. The situation where multiple users use or share the same connection or connection pool is very common in many applications; for example, multiple bank tellers might use a single connection to access the same database.

[0061] According to embodiments of the present invention, signatures for end-to-end links can be generated. Signatures can be generated based on messages associated with the end-to-end link, which may represent normal behavior of the end-to-end link. In some embodiments, signatures may include, or may be generated from, a compressed or reduced-size version of a message without a value field and / or from commands used in the end-to-end link. According to some embodiments of the present invention, end-to-end links can be grouped into similar groups or clusters using a classifier or by performing cluster analysis on the signatures. Each cluster may include a group of end-to-end links where the signatures of the end-to-end links within the cluster are close together. Once signatures are created, communication associated with the end-to-end link can be periodically checked by comparing communication on the end-to-end link with the signature or the cluster of signatures. The trust level of the end-to-end link can be determined based on this comparison.

[0062] In some embodiments, a signature can be generated by creating a construct for each (without a value field) message in the message set of the end-to-end link and creating a feature histogram from the construct, where the signature can be or may include the feature histogram. For example, the construct may include a hash or other compressed version of a message without a value field. Removing the value field of a message before compressing it can increase the consistency of the compressed value. In some embodiments, the operations used to generate the construct can reduce the number of bits, compute very quickly, and minimize collisions (which can occur when the same construct is generated for different messages). To generate a feature histogram from the construct, the construct can be divided into multiple bins. Assuming that most (without a value field) messages are similar during normal operation of the end-to-end link, hashing messages without value fields can generate typical feature histograms.

[0063] In some embodiments, the feature histogram may also include commands from the message set of the end-to-end link. For example, the feature histogram can be generated by grouping commands into command groups. Command groups may include, for example, Data Definition Language (DDL) commands, Data Manipulation Language (DML) commands, Data Query Language (DQI) commands, Data Control Language (DCL) commands, Transaction Control Language (TCL) commands, etc. Assuming that the vast majority of commands will repeat themselves during normal operation of the end-to-end link, counting the number of commands in each command group can generate a typical command histogram, which can be included in the feature histogram. Therefore, according to some embodiments, the signature of the end-to-end link may include a feature histogram comprising construction and / or command intervals.

[0064] In many database applications, the same users and other users with the same roles repeat the same operations. For example, all users acting as retail bankers may repeat the same operations multiple times a day. They may perform business transactions such as money transfers, loan approvals, and checking the accounts of many customers, each of which may be executed by hundreds of SQL statements. Therefore, according to embodiments of the invention, removing values ​​from messages can detect repetitive and shared activities. Thus, as long as the same users use end-to-end links for the same purpose, the general shape of the feature histogram can remain the same. Conversely, large deviations in the general shape of the feature histogram can serve as an indication of potential security problems.

[0065] Now for reference Figure 1The diagram illustrates an illustrative cloud computing environment 50. As shown, the cloud computing environment 50 includes one or more cloud computing nodes 10 with which local computing devices used by cloud consumers can communicate. Examples of these local computing devices include, but are not limited to, personal digital assistants (PDAs) or cellular phones 54A, desktop computers 54B, laptop computers 54C, and / or automotive computer systems 54N. Nodes 10 can communicate with each other. They can be physically or virtually grouped (not shown) in one or more networks, such as private clouds, community clouds, public clouds, or hybrid clouds, or combinations thereof, as described above. This allows the cloud computing environment 50 to provide Infrastructure as a Service, Platform as a Service, and / or Software as a Service without requiring cloud consumers to maintain resources on their local computing devices. It should be understood that... Figure 1 The types of computing devices 54A-N shown are merely illustrative, and computing node 10 and cloud computing environment 50 can communicate with any type of computerized device via any type of network and / or network-addressable connectivity (e.g., using a web browser).

[0066] Now for reference Figure 2 This demonstrates a cloud computing environment of 50 ( Figure 1 This provides a set of functional abstractions. It should be understood beforehand that... Figure 2 The components, layers, and functions shown are merely illustrative, and embodiments of the invention are not limited thereto. As depicted, the following layers and corresponding functions are provided:

[0067] Hardware and software layer 60 includes hardware and software components, such as Figure 10 The hardware and software components described herein. Examples of hardware components include: processors (e.g., ... Figure 10 The processors depicted (705), such as mainframes (61); servers (62) based on RISC (Reduced Instruction Set Computer) architecture; servers (63) and blade servers (64); storage devices (65, e.g., Figure 10 The software components include a storage device 730 (as depicted in the image), and a network and networking component 66. In some embodiments, the software components include network application server software 67 and database software 68.

[0068] The virtualization layer 70 provides an abstraction layer from which the following examples of virtual entities can be provided: virtual server 71; virtual storage 72; virtual network 73, including virtual private network; virtual application and operating system 74; and virtual client 75.

[0069] According to some embodiments, the monitored database may be implemented on virtual storage 72 and physically located on storage device 65. The database may be managed by database software 68, which may include agent software according to embodiments of the invention. The collector or data security application may be implemented by software running on virtual server 71; however, other architectures and hardware may also be used.

[0070] In one example, management layer 80 can provide the example functionalities described below. Resource Provisioning 81 provides dynamic acquisition of computing resources and other resources used to perform tasks within the cloud computing environment. Metering and Pricing 82 provides cost tracking for the use of resources in the cloud computing environment and provides bills or invoices for the consumption of these resources. In one example, these resources may include application software licenses. Security Functions provide authentication for cloud consumers and tasks and protection for data and other resources. User Portal 83 provides access to the cloud computing environment for consumers and system administrators. Service Level Management 84 provides cloud resource allocation and management to meet required service levels. Service Level Agreement (SLA) Planning and Fulfillment 85 provides pre-scheduling and procurement of cloud resources according to the SLA for its projected future needs.

[0071] Workload tier 90 provides examples of functionalities that can leverage a cloud computing environment. Examples of workloads and functionalities available in this tier include, but are not limited to: mapping and navigation 91; software development and lifecycle management 92; virtual classroom instruction provision 93; data analytics and processing 94; and transaction processing 95.

[0072] refer to Figure 3 The document describes a system 300 according to an embodiment of the present invention. According to some embodiments, the security server 330 may be implemented on a virtual server 71, and the data source machine 320 may be implemented on virtual storage 72; however, other implementations may be applied. It should be understood in advance that... Figure 3 The components and functions shown are intended to be illustrative only, and embodiments of the invention are not limited thereto.

[0073] Network 340 may include any type of network or combination of networks that can be used to support communication between database client 310, data source machine 320, and security server 330. Network 340 may include, for example, wired, wireless, fiber optic, or any other type of connection, local area network (LAN), wide area network (WAN), Internet, and intranet. Additionally or alternatively, any one of database client 310, data source machine 320, and security server 330 may be directly connected to each other.

[0074] According to some embodiments, a database client application 312 running on database client 310 can communicate with data source machine 320, for example, by generating and submitting data packets 350 or data records, including, for example, database queries, to data source machine 320. The data packets may be associated with an end-to-end link 360.

[0075] In one example, a query transmitted from database client 310 to data source machine 320 may be, or can be included in one or more database protocol packets, also referred to as data packets 350, which include a header 352 and a payload 354. The header 352 may include metadata such as machine information, network information, user information, client information, etc. For example, the header may include parameters used to define the end-to-end link 360, such as ServerHostName, ServiceName, DbName, ClientHost, OsUser, DbUser, etc. The payload 354 may include data and / or statements used for database queries, such as SQL requests or responses. Although in Figure 3 The diagram shows a single database client 310 and a single data source machine 320; however, one or more data source machines 320 may provide database services to one or more database clients 310 or client applications 312.

[0076] In one example, the payload 354 of data group 350 may include a query (e.g., a request or SQL statement) or a response to a query, collectively referred to here as message 510 (in... Figure 5 (As shown in the diagram). Queries may include Structured Query Language (SQL) statements for accessing data in tables managed by database management applications (e.g., database management application 324 and / or database software 68). SQL stands for Standardized Language, used to define and manipulate data in relational databases. For example, in a relational database model, a database can be perceived as a set of tables containing data, and data can be retrieved by using SQL statements to specify result tables that can be derived from one or more tables. Queries may be defined using one or more additional or alternative languages ​​or protocols used to define and manipulate data in relational databases or other types of databases.

[0077] The data source machine 320 may include a database 326, such as a database server, a file server, or a combination of database 326 and its proxy or gateway, database management application 324 and proxy application 322. Figure 4AThe document describes an example of a data source machine including a database server 410. The database server 410 may include a database 326 managed by a database management application 324, which may include or communicate with a proxy application 322. A similar architecture can be applied to a file server. Figure 4B A data source machine is depicted, comprising a combination of a gateway, network gateway, or proxy 422 and a database server (or file server) 420. The database server 420 may include a database 326 managed by a database management application 324. In this embodiment, the proxy application 322 is located at the gateway, network gateway, or proxy 422.

[0078] In one example, in response to a query from database client 310, database management application 324 can process the query and generate a response to the query, which is returned to database client 310 in a database server response.

[0079] Data packets 350 may flow between database client 310 and data source machine 320 over an end-to-end link 360. Agent 322 may be a computer-executed process that can capture, sniff, or intercept one or more data packets 350 along the communication flow between database client 310 and data source machine 320 without interfering with communication between data packets 350 and data source machine 320. Agent 322 may be implemented at one or more points along the communication flow between database client application 312 and data source machine 320 to monitor and capture or intercept data packets 350 without the involvement of database management application 432 (or database software 68) and without relying on any form of local auditing or local logging by database management application 324. Although drawn as part of data source machine 320, agent 322 may intercept data packets 350 at other locations (such as, but not limited to, database storage of database servers 410 and 420 within network 340), at the operating system level, or at the database library level.

[0080] End-to-end link 360 can be defined by tuples or combinations of parameters associated with data packet 350 (typically found in header 352). Tuples may include one or more user information parameters (e.g., OsUser, DbUser, App User, ClientHost (e.g., associated with database client 310)), source information, and database information (e.g., ServiceName or DbName and ServerHostName or database server IP (e.g., associated with database 326)). It may be necessary to use tuples, not just usernames (DB users), to specify end-to-end link 360 in order to identify end-to-end link 360 within a connection or connection pool, for example, when multiple users use or share a single connection or connection pool.

[0081] According to an embodiment of the invention, agent 322 can capture or intercept multiple data packets 350 flowing between data source machine 320 and database client 310. Agent 322 can capture both data packets 350 including query packets sent from data source machine 320 to database client 310 and data packets 350 including response packets sent from database client 310 to data source machine 320. Data packets 350 can be captured substantially in real time without increasing latency or waiting time.

[0082] According to some embodiments, agent 322 can decrypt captured data packets 350 to obtain a header 352 for each data packet 350. Agent 322 can analyze the header 352 to obtain header information and associate the packet with an end-to-end link 360 based on the header information. According to some embodiments of the invention, the end-to-end link 360 can be associated with a trust level, security state, or security grade or rating. According to embodiments of the invention, agent 322 can associate each data packet 350 with the security state or trust level of the end-to-end link 360 to which it belongs. The trust level can be a classification parameter, which can be, for example, "trusted" or "untrusted". Other trust levels or ratings can be used.

[0083] In some embodiments, agent 322 may apply policy rules to future messages from untrusted end-to-end links 360. According to embodiments of the invention, agent 322 may determine whether data packets 350 need to be sent to security server 330 based on or according to trust levels. Trusted end-to-end links 360 may be whitelisted, and messages 510 associated with trusted end-to-end links 360 may be ignored, for example, excluded from further security analysis, and specifically excluded from comprehensive security analysis performed by security server 330. Therefore, agent 322 may not send messages 510 associated with trusted end-to-end links 360 to security server 330. On the other hand, if an end-to-end link 360 is classified as untrusted, messages 510 associated with the untrusted end-to-end link 360 may be sent by agent 322 to security server 330 for comprehensive security analysis. In some embodiments, agent 322 may issue an alert if an end-to-end link 360 is classified as untrusted. According to embodiments of the invention, additional security measures can be taken if an end-to-end link 360 is classified as untrusted. It should be readily understood that a single end-to-end link 360 may be classified as trusted at times and untrusted at other times, as disclosed herein.

[0084] Therefore, when data packet 350 is captured, agent 322 can decrypt header 352 to obtain header information (also known as metadata), which includes, for example, machine information, network information, user information, client information, etc. Agent 322 can determine the end-to-end link 360 associated with data packet 350 based on the header information. Once the end-to-end link 360 is known, agent 322 can verify the security status associated with the end-to-end link 360 and take appropriate action. Agent 322 can determine, based on the security status, whether message 510 associated with header 352 should be blocked, allowed to flow without further analysis, or requires further security analysis. For example, header security rules can be defined as follows: if the user is known to be a malicious entity, message 510 from a specific end-to-end link 360 should be blocked; if the end-to-end link 360 is trusted, the message should be allowed to flow without further analysis (e.g., ignored); or if the state of the end-to-end link 360 is untrusted, the message should be further analyzed. Other header security rules or combinations of header security rules can be used. Since the header structure is known, header 352 decryption and analysis can be performed in real time without introducing significant delays.

[0085] According to embodiments of the present invention, agent 322 can generate a signature 362 for end-to-end link 360. For example, during the preparation phase as disclosed herein and during the operation phase, agent 322 can generate the signature 362 based on messages 510 sent through end-to-end link 360 and captured by agent 322. Thus, signature 362 can represent the normal behavior of end-to-end link 360. To generate signature 362, agent 322 can capture messages 510 within a time window of the preparation phase (also known as the training phase), or until a sufficient number of messages 510 are captured. For example, in a typical application, approximately 150,000-400,000 messages 510 may be required to generate signature 362. In some embodiments, the preparation phase may include multiple sessions (a session can refer to a logical representation of a connection to a database from login to logout). In some embodiments, agent 322 may capture messages 510 to generate signature 362 within one or two minutes of the first 20-40 sessions. Other time windows for capturing messages to generate signature 362 may be used. According to an embodiment of the invention, agent 322 can generate signature 362 for end-to-end link 360 using high-capacity or high-rate messages 510. For example, agent 322 may not generate signatures for sessions where the message rate is below a threshold (e.g., less than 100 messages per second).

[0086] In some embodiments, all messages 510 used to generate signature 362 may undergo a comprehensive security analysis as disclosed herein, or be otherwise examined to verify that they represent the normal behavior of end-to-end link 360.

[0087] Signature 362 may include a compressed or reduced-size version of message 510 captured during the preparation phase that has no value field. Once signature 362 is created, agent 322 can periodically check communication on end-to-end link 360 by comparing message 510 on end-to-end link 360 with signature 362. Based on this comparison, agent 322 can calculate or determine the trust level of end-to-end link 360. According to some embodiments, the preparation phase and signature 362 generation may be repeated periodically, for example, weekly or annually.

[0088] According to some embodiments, signature 362 may include a feature histogram associated with message 510 transmitted via end-to-end link 360 during the preparation phase. The histogram generated during the preparation phase may herein be referred to as the feature histogram of end-to-end link 360. In this case, the comparison may be performed by sampling message 510 within a time window during the operation phase, as disclosed herein, generating a working histogram, and comparing the working histogram with the feature histogram.

[0089] Now for reference Figure 5The document depicts messages 510, frames 520, structures 530, and histograms 540 of an end-to-end link 360 according to an embodiment of the present invention. Histogram 540 may represent a feature histogram or an operational histogram. For example, to generate a feature histogram (e.g., signature 362), agent 322 may capture messages 510 during a training or preparation phase, and to generate an operational histogram, agent 322 may capture messages 510 during runtime or an operation phase.

[0090] In some embodiments, agent 322 can generate histogram 540 by generating frame 520 from each message 510 used to generate histogram 540, generating construct 530 from each frame 520, and generating histogram 540 from construct 530. Histogram 540 may be a signature 362 (or a portion thereof) for an end-to-end link 360 of messages captured during the preparation phase, and a working histogram for messages captured during runtime or operation phase.

[0091] Agent 322 can generate frame 520 from message 510 by removing values ​​from message 510. These values ​​can be or may refer to specific data elements stored in a database table. Therefore, frame 520 may include message 510 without value fields. An example of an SQL statement is provided below:

[0092] Example 1: Select NAME from EMPLOYEE, where DEPARTMENT = “SALE” and BAND > 8;

[0093] Example 2: Select FULL_NAME and ADDRESS from CUSTOMER and PHONE, where PHONE.PHONE_NO is such as "01230123012%", and CUSTOMER.CUSTOMER_ID = PHONE.CUSTOMER_ID;

[0094] In Example 1, the values ​​are "SALE" and "8", and in Example 2, the value is the phone number "01230123012". These examples are for requests. Responses typically include column headers and values. Therefore, to generate frame 520 from the response, the values ​​can be removed, and frame 520 can include column headers.

[0095] Agent 322 can generate construct 530 from frame 520 by hashing or using other compression methods. The operations used to generate construct 530 reduce the number of bits in message 510, are computed very quickly, and minimize collisions; for example, in some cases, the same construct 530 should not be generated for different frames 520, or should be generated very rarely. In typical applications, for complex statements, the length of frame 520 can range from tens to thousands of characters. The hash of frame 520 can be as long as approximately 15-25 characters.

[0096] To generate the feature histogram 540, agent 322 can divide the values ​​of construct 530 into a series of intervals, typically consecutive, adjacent, and non-overlapping intervals, each of which can be called a bin or bucket. Agent 322 can then count how many constructs 530 fall into each bin. Bins can have equal or unequal sizes. It is assumed that messages 510 of the end-to-end link 360 can repeat themselves or be similar to each other, especially when values ​​are removed. Therefore, generating the feature histogram 540 based on the frame 520 of messages 510 can represent the common behavior of the end-to-end link 360. Thus, it can be expected that the distribution of messages 510 of the end-to-end link 360 will remain similar to the feature histogram.

[0097] According to some embodiments, in addition to or as an alternative to configuration 530, histogram 540 may include commands used in message 510. For example, agent 322 may divide the commands 550 included in message 510 into command groups. For example, command groups may include DDL, DML, DQI, DCL, TCL, etc. Thus, each command group may be a repository in histogram 540, and agent 322 may place each command in the appropriate repository based on the type of command.

[0098] According to an embodiment of the invention, during the operational phase, as long as the end-to-end link 360 is flagged or classified as trusted, the agent 322 may not send the message 510 associated with the end-to-end link 360 to the security server 330 for comprehensive security analysis. This can significantly reduce the computing power required at the security server 330. However, to detect hijacking attacks, the agent 322 may sample the message 510 associated with the end-to-end link 360 from time to time, for example periodically, such as every 10-30 minutes and / or for each new session, and check for changes in the signature, such as feature histograms. According to an embodiment of the invention, the agent 322 may sample the message 510 of the end-to-end link 360 and check for changes in the signature 362 only in sessions with high volume or high rate of messages 510. For example, the agent 322 may not check the signed messages of sessions with message rates below a threshold (e.g., below 100 messages per second). Instead, the messages 510 of those sessions can undergo comprehensive security analysis because they do not contain large amounts of data and therefore do not introduce a high load on the system.

[0099] For example, agent 322 may sample messages 510 associated with end-to-end link 360 during a sampling time window. The sampling time window may be of a fixed length (e.g., 1-2 minutes) or may continue until a sufficient number of messages 510 have been sampled (e.g., 100-400 messages). According to an embodiment of the invention, agent 322 may generate a working histogram 540 from the sampled messages 510, as disclosed herein.

[0100] Now for reference Figure 6A A comparison of the operational histogram 610 and the feature histogram 620 of the end-to-end link 360 according to an embodiment of the present invention is depicted. Figure 6A As disclosed herein, a feature histogram 620 is generated during the preparation phase, and a working histogram 610 is generated during the operation phase. According to embodiments of the invention, agent 322 can compare 602 the working histogram 610 and the feature histogram 620 to determine a trust level 604 for the end-to-end link 360. In some embodiments, agent 322 can determine the trust level 604 directly from the comparison 602, and in some embodiments, agent 322 can calculate a security level based on the comparison 602 and can determine the trust level 604 by comparing the security level to a threshold. The comparison 602 can be performed using any applicable statistical or other methods. For example, agent 322 can compare 602 the variance of the working histogram 610 with the variance of the feature histogram 620. For example, agent 322 can determine that the end-to-end link 360 can remain trustworthy if, for example, the following are true, and the end-to-end link 360 can be classified as untrustworthy if the following are false (other rules may be used):

[0101] work_histogram_varianc<2* characteristic_histogram_variance (Equation 1)

[0102] Now for reference Figure 6B The diagram depicts a comparison 606 between an operational histogram 610 of an end-to-end link 360 according to an embodiment of the invention and multiple feature histograms 620, 622, 624 of multiple end-to-end links 360, 362, 364, wherein each end-to-end link belongs to a cluster 630 of the end-to-end links 360, 362, 364. Although cluster 630 is depicted as including three end-to-end links 360, 362, 364, this is merely an example, and cluster 630 may include any number of end-to-end links.

[0103] Agent 322 can find clusters 630 of end-to-end links 360, 362, and 364, wherein features used for clustering may include, for example, the construction of end-to-end links 360, 362, and 364 and / or commands used in end-to-end links 360, 362, and 364. For example, commands used in end-to-end links 360, 362, and 364 can be grouped into command groups such as DDL, DML, DQI, DCL, TCL, etc. Clustering algorithms can be used to find clusters where each includes similar end-to-end links, such as end-to-end links with common constructions and commands. In some embodiments, k-means clustering can be used to divide end-to-end links 360 into k clusters 630, where each end-to-end link 360 belongs to the cluster 630 with the closest mean. Other clustering methods can be used.

[0104] In some embodiments, agent 322 may (e.g., using Equation 1) compare working histogram 610 with each feature histogram 620, 622, and 624 of cluster 630 of end-to-end link 360 to determine the trust level 604 of end-to-end link 360. For example, in some embodiments, it is sufficient that Equation 1 is true for all feature histograms 620, 622, and 624 for which end-to-end link 360 is considered trustworthy, and that Equation 1 is false for one of the feature histograms 620, 622, and 624 for which end-to-end link 360 is considered untrustworthy. Other rules and terms may be used to determine the trust level of end-to-end link 360.

[0105] Now for reference Figure 6CThe diagram depicts a comparison 608 between the working histogram 610 of the end-to-end link 360 according to an embodiment of the invention and the common feature histogram 640 of the cluster 630 of the end-to-end links 360, 362, and 364. In some embodiments, a common feature histogram 640 common to all end-to-end links in cluster 630 may be generated, and the working histogram 610 of the end-to-end link 360 may be compared 608 with the common feature histogram 640 (e.g., similar to comparison 602) to determine the trust level of the end-to-end link 360.

[0106] According to embodiments of the present invention, calculating the trust level of the end-to-end link 360 should be fast to enable real-time operation. According to embodiments of the present invention, this requirement is achieved because calculating hash values ​​and comparing histograms requires fewer computational resources. The dynamic whitelisting according to embodiments of the present invention can dynamically reduce the computational power required to perform comprehensive security analysis.

[0107] return Figure 3 According to an embodiment of the present invention, if the trust level of the end-to-end link 360 changes from trusted to untrusted, the agent 322 may send the data packet 350 of the end-to-end link 360 to the security server 330. Additionally or alternatively, if the trust level of the end-to-end link 360 changes from trusted to untrusted, the agent 322 may issue a security alert. Additionally or alternatively, if the trust level of the end-to-end link 360 changes from trusted to untrusted, the agent 322 may block the data packet 350 of the end-to-end link 360.

[0108] Security server 330 can implement or execute data security application 332. Data security application 332 can be or may include firewalls, DAM and / or FAM, external database non-intrusive security mechanisms (EDSM), enterprise database auditing, and real-time protection. Data security application 332 can provide database activity monitoring services for data source machine 320, including performing comprehensive security analysis. Data security application 332 can provide continuous monitoring of database activity on data source machine 320. Examples of data security application 332 may include, but are not limited to, the Guardium® application available from IBM.

[0109] According to an embodiment of the present invention, data security application 332 can receive or obtain data packets 350. Comprehensive security analysis may include: parsing the data packets, mapping metadata to data, establishing a hierarchy of data (e.g., establishing a name-value hierarchical tree), and processing policy rules. Processing policy rules may require associated names and values. For example, a rule may include "if the name (e.g., %ID%) and value match a specific regular expression (Regex)," or a rule may expect a postal code plus a street name.

[0110] According to some embodiments, data security application 332 can extract database queries or responses to database queries from intercepted messages 510, parse the extracted database queries or responses, and create a security structure according to database protocol rules. Rules may include, but are not limited to, the type of operation or command identified in the query, the database object to be operated on by the operation, the user identifier of the user requesting the query, the identifier of the service IP address, the client IP address, the client MAC address, the network protocol used to access the data, the database type, the service name of the service used to provide the data, the name of the database accessed, the source application used for data access, the application user name, the operating system user, database-related fields, error codes, exception types, the service IP address of the location of the accessed data, and additional or alternative rules.

[0111] According to some embodiments, data security application 332 can verify potential database object access violations in a security architecture against a security policy defined by policy rules. In one example, if the security architecture is not verified against a security policy, data security application 332 can issue an alert to an administrator or other entity, indicating that the intercepted data packet 350 failed to verify against the security rules. In one example, an administrator or service can set each rule. According to some embodiments, security rules can include one or more settings, such as, but not limited to, operation type settings specifying the types of access allowed or disallowed by operations, object settings specifying one or more specific database objects to which the operation is performed, and user settings specifying one or more user identifiers for the user requesting the operation on the database object. For example, operations that can be restricted by security rules can include, but are not limited to, operations such as create, select, update, and delete. Security settings can include additional or replacement types of settings.

[0112] Each of the database client 310, security server 330, and data server 420 may be or may include, for example, Figure 10 The computing device 700 depicted herein is a computing device. One or more databases 326 may be or may include storage devices such as storage device 730.

[0113] refer to Figure 7 This is a flowchart of a method for associating messages with an end-to-end link according to an embodiment of the present invention. It can be achieved, for example... Figure 1 , Figure 2 , Figure 3 , Figure 4A , Figure 4B and Figure 10 The system shown is an embodiment of a method for associating messages with an end-to-end link. The process of associating messages with an end-to-end link can be repeated for multiple data packets flowing between a data source machine and a data client.

[0114] In operation 742, a data packet (e.g., data packet 350) may be captured. The data packet may include a header 352 and a payload 354, which includes a query sent by a data client to the database or a database response to a query (e.g., message 510). For example, an instance of agent software located at and executing on a data source machine (e.g., a database server, or a proxy or network gateway for the database server) may capture the data packet. In operation 744, agent 322 may decrypt the data packet to obtain its header and message. Agent 322 may analyze the header to obtain parameters of the end-to-end link, such as ServerHostName, ServiceName, DbName, ClientHost, OsUser, DbUser, etc. In operation 746, agent 322 may analyze the header as disclosed herein to associate the packet with an end-to-end link, for example, based on parameters extracted from the header.

[0115] refer to Figure 8 This is a flowchart of a method for generating a feature histogram according to an embodiment of the present invention. Embodiments of the method for generating a feature histogram may be, for example, derived from... Figure 1 , Figure 2 , Figure 3 , Figure 4A , Figure 4B and Figure 10 The system shown is executed. Embodiments of the method for generating feature histograms can be performed, for example, during a training or preparation phase. According to some embodiments, feature histogram generation can be repeated periodically, for example, weekly or monthly, to keep the feature histogram updated. Embodiments of the method for generating feature histograms can be executed on an end-to-end link 360 with high-volume or high-rate messages, for example, more than 100 messages per second.

[0116] In operation 750, agent 322 may acquire a message set for a single end-to-end link. The message set may include a predetermined number of messages or messages acquired within a predetermined time window. For example, in a typical application, in operation 750, agent 322 may capture approximately 150,000-400,000 messages for a single end-to-end link. In some embodiments, agent 322 may capture messages from multiple sessions of a single end-to-end link. In some embodiments, in operation 750, agent 322 may capture messages within the first minute or two minutes of 20-40 sessions of a single end-to-end link. Other time windows may be used to capture messages to generate signatures. In operation 752, agent 322 may generate a frame from each message. The frame may include message text in addition to value fields. In operation 754, agent 322 may generate a constructed or compressed form of each frame. For example, agent 322 may hash the frame to obtain a construction. In operation 755, agent 322 may extract commands from each message. In operation 756, agent 322 may generate feature histograms for the end-to-end links. For example, agent 322 may generate feature histograms from the construct, as disclosed herein. Additionally or alternatively, agent 322 may generate feature histograms from commands by dividing the commands of the message into command groups, as disclosed herein. Operations 750-756 may be repeated for multiple end-to-end links such that feature histograms can be generated for each of the multiple end-to-end links. In operation 758, agent 322 may cluster or classify the end-to-end links to obtain end-to-end link clusters. In some embodiments, clustering or classification may be performed based on the construct and commands of the end-to-end links, as disclosed herein. In some embodiments, agent 322 may generate feature histograms for the clusters of end-to-end links. In some embodiments, agent 322 may generate feature histograms for each of the multiple end-to-end links in the cluster.

[0117] refer to Figure 9 This is a flowchart of a method for dynamically determining the trust level of an end-to-end link in a computer database, according to an embodiment of the present invention. Embodiments of the method for dynamically determining the trust level of an end-to-end link can be, for example, derived from... Figure 1 , Figure 2 , Figure 3 , Figure 4A , Figure 4B and Figure 10The system shown is used to perform this process. The process for determining the trust level of an end-to-end link to a computer database can be performed periodically and / or repeated for each new session. Embodiments of a method for dynamically determining the trust level of an end-to-end link can be executed, for example, for end-to-end links with high-volume or high-rate messages. For example, agent 322 can determine the trust level of an end-to-end link for sessions with message rates below a threshold (e.g., less than 100 messages per second). Conversely, messages from sessions with message rates below the threshold can undergo comprehensive security analysis.

[0118] In operation 760, agent 322 may obtain a message set (also referred to as a second message set) for a single end-to-end link. The message set may include a predetermined number of messages (e.g., 100-400 messages). In operation 762, agent 322 may generate a frame from each message. The frame may include message text other than value fields. In operation 764, agent 322 may generate a constructed or compressed form of each frame. For example, agent 322 may hash the frame to obtain the construct. In operation 765, agent 322 may extract commands from each message in the second message set. In operation 766, agent 322 may generate a working histogram for the end-to-end link. For example, agent 322 may generate a working histogram from the construct, as disclosed herein. Additionally or alternatively, agent 322 may generate a working histogram from the commands of the message by dividing the commands into command groups, as disclosed herein.

[0119] In operation 768, agent 322 may compare the working histogram with the feature histogram. In some embodiments, agent 322 may compare the working histogram with the feature histogram of the same end-to-end link. In some embodiments, agent 322 may compare the working histogram with the feature histogram of the cluster of end-to-end links to which the end-to-end link belongs. In some embodiments, agent 322 may compare the working histogram with each of the multiple feature histograms of the cluster of end-to-end links to which the end-to-end link belongs.

[0120] In operation 770, agent 322 can determine the trust level of the end-to-end link. For example, agent 322 can determine the trust level of the end-to-end link based on comparison. In some embodiments, agent 322 can compare the variance of the working histogram with the variance of the feature histogram, and if the variance of the working histogram is larger than the variance of the feature histogram by a predetermined factor, such as two, then the trust level of the end-to-end link is determined to be untrustworthy. Other rules may be applied. Additionally or alternatively, if at least one construction in the construction of the second message set is new, agent 322 can determine the trust level of the end-to-end link to be untrustworthy. If the construction of the second message set is not included in the feature histogram, agent 322 can determine that the construction is new. Therefore, according to some embodiments, for an end-to-end link to be considered or classified as untrustworthy, it is sufficient that the working histogram of the end-to-end link is different from the feature histogram of the end-to-end link, or that at least one construction in the construction of the second message set is new. Otherwise, the end-to-end link can be considered or classified as trustworthy.

[0121] According to some embodiments, if the end-to-end link is determined to be trustworthy, agent 322 may not send end-to-end link messages to security server 330 for comprehensive security analysis. According to some embodiments, agent 322 may add constructions used to generate a working histogram to the feature histogram to keep the feature histogram updated. According to some embodiments, if the end-to-end link is determined to be untrustworthy in operation 770, agent 322 may apply policy rules to future messages of the end-to-end link, and if the end-to-end link is trustworthy, agent 322 may omit applying policy rules to future messages of the end-to-end link. For example, if the end-to-end link is untrustworthy, agent 322 may send end-to-end link messages to security server 330 for comprehensive security analysis. In operation 778, if the end-to-end link is untrustworthy, agent 322 may issue a security alert.

[0122] Figure 10 An example computing device according to an embodiment of the present invention is illustrated. Various components such as database client 310, security server 330, data source machine 320, database servers 410 and 420, gateway or proxy 422, proxy application 322 and other modules may be or include computing device 700, or be executed by it, or may include such components as... Figure 10 The components shown. For example, according to an embodiment of the invention, a first computing device 700 having a first processor 705 can be used to classify data in real time for data stream transmission.

[0123] Computing device 700 may include a processor 705 (which may be, for example, a central processing unit (CPU), a chip, or any suitable computing or computing device), an operating system 715, a memory 720, a storage device 730, an input device 735, and an output device 740. The processor 705 may be or include one or more processors that are co-located or distributed. Computing device 700 may be, for example, a workstation or personal computer, or may be implemented at least partially by one or more remote servers (e.g., in the "cloud"). For example, computing device 700 may include... Figure 1 and Figure 2 The cloud computing environment described in the text is 50.

[0124] For example, operating system 715 may be or may include any code segment designed and / or configured to perform tasks involving coordinating, scheduling, arbitrating, supervising, controlling, or otherwise managing the operation of computing device 700. Operating system 715 may be a commercial operating system. Operating system 715 may be or may include any code segment designed and / or configured to provide a virtual machine (e.g., an emulation of a computer system). Memory 720 may be or may include, for example, random access memory (RAM), read-only memory (ROM), dynamic RAM (DRAM), synchronous DRAM (SD-RAM), dual data rate (DDR) memory chips, flash memory, volatile memory, non-volatile memory, cache memory, buffers, short-term memory cells, long-term memory cells, or other suitable memory cells or storage units. Memory 720 may be or may include multiple possibly different memory cells.

[0125] Executable code 725 can be any executable code, such as an application, program, process, task, or script. Executable code 725 can be executed by processor 705 under the control of operating system 715. For example, according to embodiments of the invention, executable code 725 can be or include software for dynamically determining the trust level of an end-to-end link to a computer database. In some embodiments, more than one computing device 700 can be used. For example, multiple computing devices including components similar to those included in computing device 700 can be connected to a network and used as a system.

[0126] Storage device 730 may be or may include, for example, a hard disk drive, floppy disk drive, optical disk (CD) drive, recordable CD (CD-R) drive, Universal Serial Bus (USB) device, or other suitable removable and / or fixed storage unit. Storage device 730 may include or may store one or more databases, including database 326. In some embodiments, this may be omitted. Figure 10Some of the components shown. For example, memory 720 may be a non-volatile memory with the storage capacity of storage device 730. Therefore, although shown as a separate component, storage device 730 may be embedded in or included in memory 720.

[0127] Input device 735 may be or may include a mouse, keyboard, touchscreen, touchpad, or any suitable input device. It will be appreciated that any suitable number of input devices can be operatively connected to computing device 700. Output device 740 may include one or more displays, speakers, and / or any other suitable output devices. It will be appreciated that any suitable number of output devices can be operatively connected to computing device 700. Any suitable input / output (I / O) device may be connected to computing device 700. For example, a wired or wireless network interface card (NIC), modem, printer or fax machine, universal serial bus (USB) device, or external hard drive may be included in input device 735 and / or output device 740. A network interface enables device 700 to communicate with one or more other computers or networks. For example, a network interface may include Wi-Fi or Bluetooth devices or connections, connections to an intranet or the Internet, antennas, etc.

[0128] The embodiments described in this disclosure may include the use of a dedicated or general-purpose computer that includes various computer hardware or software modules, as discussed in more detail below.

[0129] Embodiments within the scope of this disclosure also include computer-readable media or non-transitory computer storage media for carrying or storing computer-executable instructions or data structures thereon. When the instructions are executed, a processor can perform embodiments of the invention. Such computer-readable media or computer storage media can be any available medium accessible by a general-purpose or special-purpose computer. By way of example and not limitation, such computer-readable media may include RAM, ROM, EEPROM, CD-ROM or other optical disc storage, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to carry or store desired program code in the form of computer-executable instructions or data structures and is accessible by a general-purpose or special-purpose computer. When information is transmitted or provided to a computer via a network or another communication connection (hardwired, wireless, or a combination of hardwired and wireless), the computer appropriately considers that connection as a computer-readable medium. Therefore, any such connection is appropriately referred to as a computer-readable medium. Combinations of the above should also be included within the scope of computer-readable media.

[0130] Computer-executable instructions include, for example, instructions and data that cause a general-purpose computer, a special-purpose computer, or a special-purpose processing device to perform a particular function or group of functions. Although the subject matter has been described in language specific to structural features and / or methodological actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. Rather, the specific features and actions described above are disclosed as exemplary forms of implementing the claims.

[0131] As used herein, the terms "module" or "component" can refer to a software object or routine that executes on a computing system. The various components, modules, engines, and services described herein can be implemented as objects or processes that execute on a computing system (e.g., as separate threads). While the systems and methods described herein are preferably implemented in software, implementation in hardware or a combination of software and hardware is also possible and contemplated. In this specification, "computer" can be any computing system as previously defined herein, or any module or combination of modules running on a computing system.

[0132] For the disclosed processes and / or methods, the functions performed within the processes and methods may be implemented in different orders as indicated by the context. Furthermore, the steps and operations outlined are provided only as examples, and some of these steps and operations may optionally be combined into fewer steps and operations, or extended into additional steps and operations.

[0133] This disclosure should not be limited to the specific embodiments described in this application, which are intended to illustrate various aspects. Many modifications and variations can be made without departing from the scope of the invention. In addition to those listed, functionally equivalent methods and apparatus within the scope of this disclosure will be apparent to those skilled in the art from the foregoing description. These modifications and variations are intended to fall within the scope of the appended claims. This disclosure is limited only by the terminology of the appended claims and the full scope of their authorized equivalents. It should also be understood that the terminology used in this disclosure is for the purpose of describing particular embodiments only and is not intended to be limiting.

[0134] This disclosure may sometimes illustrate different components contained within or connected to different other components. The architecture described is merely exemplary, and many other architectures can be implemented to achieve the same or similar functionality.

[0135] The aspects of this disclosure may be embodied in other forms without departing from its spirit or essential characteristics. The described aspects should be considered illustrative rather than restrictive in all respects. The claimed subject matter is indicated by the appended claims rather than by the foregoing description. All modifications within the equivalent meaning and scope of the claims are included within their scope.

Claims

1. A method for dynamically determining the trust level of an end-to-end link in a computer database, the method comprising: During the preparation phase: Capture the first set of messages in the first end-to-end link; Compress the frame of each message in the first message set to generate a construction for each message in the first message set, wherein the frame includes the message without a value field; and Create a feature histogram of the first message set as described above; During the operational phase: Capture the second set of messages from the first end-to-end link; Compress the frame of each message in the second message set to generate the construction of each message in the second message set; The working histogram of the construction of the second message set is created; and The trust level of the first end-to-end link is determined by comparing the working histogram with the feature histogram.

2. The method according to claim 1, wherein, The end-to-end link is defined based on the parameters of the end-to-end link, wherein the parameters are selected from a list including the following: host name, service name, database name, client host name, operating system user, and database user.

3. The method according to claim 1, wherein, Determining the trust level of the end-to-end link includes: if at least one construct in the construct of the second message set is not included in the feature histogram of the construct in the first message set, then the trust level of the end-to-end link is determined to be untrustworthy.

4. The method according to claim 1, wherein, The compression framework includes: hashing the framework.

5. The method according to claim 1, comprising: During the preparation phase: Commands from the first message set, which are divided into command groups, are added to the feature histogram; as well as During the operation phase: Commands from the second message set, which will be divided into the command groups, are added to the working histogram.

6. The method according to claim 1, comprising: During the preparation phase: Obtain multiple message sets, where each set is associated with an end-to-end link in the end-to-end link set; The construction of each message in the plurality of message sets is generated; A feature histogram is created for each end-to-end link in the set of end-to-end links, wherein each feature histogram is created from the construction of the message set of the end-to-end links in the set of end-to-end links; and Perform clustering of the feature histogram to determine the clustering of end-to-end links; and during operation: The working histogram is compared with each feature histogram in the feature histogram of the cluster of the first end-to-end link to determine the trust level of the first end-to-end link.

7. The method according to claim 1, wherein, For each new session, a second set of messages is captured periodically.

8. The method according to claim 1, wherein, The trust level is selected from trusted and untrusted, and the method includes: If the trust level is trusted, then no comprehensive security analysis is performed on future messages for the end-to-end link; and If the trust level is untrusted, the policy rule will be applied to future messages in the end-to-end link.

9. The method according to claim 1, comprising: If the trust level is trusted, then the construction of each message in the second message set is added to the feature histogram.

10. The method according to claim 1, wherein, The working histogram and the feature histogram are compared by comparing the variance of the working histogram with the variance of the feature histogram.

11. A system for dynamically determining the trust level of an end-to-end link, the system comprising: Memory; as well as The processor is configured as follows: During the preparation phase: Obtain the first message set of the first end-to-end link; Compress the frame of each message in the first message set to generate a construction for each message in the first message set, wherein the frame includes the message without a value field; and The feature histogram of the construction of the first message set is created; and During the operational phase: Obtain the second message set of the first end-to-end link; Compress the frame of each message in the second message set to generate the construction of each message in the second message set; The working histogram of the construction of the second message set is created; and The trust level of the first end-to-end link is determined by comparing the working histogram with the feature histogram.

12. The system according to claim 11, wherein, The processor is configured to define the end-to-end link based on parameters of the end-to-end link, wherein the parameters are selected from a list including: host name, service name, database name, client host name, operating system user, and database user.

13. The system according to claim 11, wherein, The processor is configured to determine the trust level of the end-to-end link by: determining the trust level of the end-to-end link as untrusted if at least one construct in the construct of the second message set is not included in the feature histogram of the construct of the first message set.

14. The system according to claim 11, wherein, The processor is configured to compress the frame by hashing the frame.

15. The system according to claim 11, wherein, The processor is configured to: During the preparation phase: Commands from the first message set, which are divided into command groups, are added to the feature histogram; as well as During the operation phase: Commands from the second message set, which will be divided into the command groups, are added to the working histogram.

16. The system according to claim 11, wherein, The processor is configured to: During the preparation phase: Obtain multiple message sets, where each set is associated with an end-to-end link in the end-to-end link set; The construction of each message in the plurality of message sets is generated; A feature histogram is created for each end-to-end link in the set of end-to-end links, wherein each feature histogram is created from the construction of the message set of the end-to-end links in the set of end-to-end links; and Perform clustering of the feature histogram to determine the clustering of end-to-end links; During operation: The working histogram is compared with each feature histogram in the feature histogram of the cluster of the first end-to-end link to determine the trust level of the first end-to-end link.

17. The system according to claim 11, wherein, The processor is configured to periodically capture a second set of messages for each new session.

18. The system according to claim 11, wherein, The trust level is selected from trusted and untrusted, wherein the processor is configured as follows: If the trust level is trusted, then no comprehensive security analysis is performed on future messages for the end-to-end link; and If the trust level is untrusted, the policy rule will be applied to future messages in the end-to-end link.

19. The system according to claim 11, wherein, The processor is configured to: If the trust level is trustworthy, then the construction of each message in the second message set is added to the feature histogram.

20. The system according to claim 11, wherein, The processor is configured to compare the working histogram with the feature histogram by comparing the variance of the working histogram with the variance of the feature histogram.

Images