Method and system for dynamically determining the trust level of an end-to-end link

Abstract

A method for dynamically determining a trust level of an end-to-end link in a database, comprising: capturing a first set of messages of the end-to-end link; compressing a skeleton of each message of the first set of messages to generate a construct for each message of the first set of messages; creating a feature histogram of the constructs of the first set of messages; during an operation stage, capturing a second set of messages of the end-to-end link; compressing a skeleton of each message of the second set of messages to generate a construct for each message of the second set of messages; creating a work histogram of the constructs of the second set of messages; and determining the trust level of the end-to-end link by comparing the work histogram with the feature histogram.

Description

[Technical field]

[0001] The present invention relates generally to dynamic whitelisting, and more particularly to dynamically determining the trust level of an end-to-end link from a user to a computer database. [Background technology]

[0002] A data firewall typically captures or sniffs data access (e.g., requests and responses) to a database in real time and analyzes the data according to policy rules. A data firewall may include a database activity monitor (DAM) or a file activity monitor (FAM) or both. The requests and responses sniffed by a data firewall may include requests, e.g., Structured Query Language (SQL) statements, or responses, and associated header information. The headers may include metadata, such as machine information, network information, user information, client information, etc.

[0003] The canonical solution for DAM is to deploy an agent on the data source server (e.g., database server). The agent may capture, mirror, or sniff requests and responses and send the requests and responses to a security server. The security server may analyze the data, perform policy enforcement, and then audit, analyze, alert, or block the requests and responses as necessary. One of the main challenges for DAM is the sheer volume of data that must be captured and analyzed. For example, in a typical enterprise environment, a DAM may capture or sniff approximately 100 million transactions (e.g., requests and responses) per second (TPS). Sniffing and analyzing such a huge amount of data in real time or near real time requires an appropriate computer infrastructure, which can be very expensive.

[0004] Therefore, there is a need for a method to reduce the amount of data that is analyzed. Summary of the Invention

[0005] According to an embodiment of the present invention, a system and method for dynamically determining a trust level of an end-to-end link in a computer database may include, in a preparation stage, capturing a first set of messages of a first end-to-end link, compressing a skeleton of each message of the first set of messages to generate a construct for each message of the first set of messages, the skeleton including messages that do not include a value field, and creating a characteristic histogram of the constructs of the first set of messages; and, during an operation stage, capturing a second set of messages of the first end-to-end link, compressing a skeleton of each message of the second set of messages to generate a construct for each message of the second set of messages, creating a work histogram of the constructs of the second set of messages, and determining a trust level of the first end-to-end link by comparing the work histogram to the characteristic histogram.

[0006] According to an embodiment of the present invention, an end-to-end link is defined according to parameters of the end-to-end link, the parameters being selected from a host name, a service name, a database name, a client host name, an operating system user, and a database user.

[0007] According to an embodiment of the present invention, determining a trust level of the end-to-end link may include determining that the trust level of the end-to-end link is not trusted if at least one of the constructs of the second set of messages is not included in the feature histogram of the constructs of the first set of messages.

[0008] According to an embodiment of the present invention, compressing the skeleton may include hashing the skeleton to produce a hash.

[0009] An embodiment of the invention may include, during a preparation stage, adding commands of a first set of messages split into command groups to a feature histogram, and during an operation stage, adding commands of a second set of messages split into command groups to a work histogram.

[0010] An embodiment of the present invention may include, in a preparation stage, obtaining a plurality of sets of messages, each set associated with an end-to-end link of the set of end-to-end links; generating constructs for each message of the plurality of sets of messages; creating a feature histogram for each end-to-end link of the set of end-to-end links, each feature histogram being created from constructs of the set of messages for an end-to-end link of the set of end-to-end links; clustering the feature histograms to determine clusters of the end-to-end links; and, during operation, comparing the work histogram with each of the feature histograms of the cluster of the first end-to-end link to determine a trust level of the first end-to-end link.

[0011] According to an embodiment of the present invention, capturing the second set of messages may be repeated periodically for each new session.

[0012] According to an embodiment of the invention, the trust level is selected from trusted and untrusted, and an embodiment of the invention may include not performing a comprehensive security analysis on subsequent messages in the end-to-end link if the trust level is trusted, and applying policy rules to subsequent messages in the end-to-end link if the trust level is untrusted.

[0013] An embodiment of the present invention may include adding each construct of the second set of messages to the feature histogram if the trust level is trusted.

[0014] According to an embodiment of the present invention, a work histogram may be compared to a feature histogram by comparing the variance of the work histogram to the variance of the feature histogram.

[0015] The subject matter which is regarded as the invention is particularly pointed out and distinctly claimed in the concluding portion of this specification, however, embodiments of the invention, both as to organization and method of operation, together with their objects, features, and advantages, may best be understood by reference to the following detailed description read in conjunction with the accompanying drawings, in which: Embodiments of the invention are illustrated by way of example, and not limitation, in the figures of the accompanying drawings in which like reference characters indicate corresponding, similar or similar elements. [Brief description of the drawings]

[0016] [Figure 1] FIG. 1 illustrates a cloud computing environment in accordance with one embodiment of the present invention. [Diagram 2] FIG. 2 illustrates abstraction model layers according to one embodiment of the present invention. [Diagram 3] FIG. 1 illustrates a system according to an embodiment of the present invention. [Figure 4A] FIG. 2 illustrates an example of a data source machine including a database server according to an embodiment of the present invention. [Figure 4B]A diagram depicting a data source machine including a combination of a gateway, network gate, or proxy and a database server. [Diagram 5] 1 illustrates messages, skeletons, constructs, and feature histograms for an end-to-end link according to an embodiment of the present invention. [Figure 6A] 1 illustrates a comparison of an end-to-end link work histogram and an end-to-end link feature histogram according to an embodiment of the present invention. [Figure 6B] FIG. 1 illustrates a comparison of a work histogram of an end-to-end link with a number of feature histograms of a number of end-to-end links each associated with a cluster of end-to-end links, according to an embodiment of the present invention. [Figure 6C] FIG. 10 illustrates a comparison of a work histogram of an end-to-end link with a common feature histogram of a cluster of end-to-end links according to an embodiment of the present invention. [Figure 7] 4 is a flowchart of a method for associating a message with an end-to-end link according to an embodiment of the present invention. [Figure 8] 4 is a flowchart of a method for generating a feature histogram according to an embodiment of the present invention. [Figure 9] 1 is a flowchart of a method for dynamically determining a trust level of an end-to-end link of computer databases according to an embodiment of the present invention. [Figure 10] FIG. 1 illustrates an exemplary computing device in accordance with an embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0017] It will be appreciated that for simplicity and clarity of illustration, elements shown in the figures have not necessarily been drawn to scale. For example, dimensions of some of the elements may be exaggerated relative to other elements for clarity. Further, where considered appropriate, reference numerals may be repeated among the figures to indicate corresponding or analogous elements.

[0018] In the following description, various aspects of the present invention are described. For purposes of explanation, specific configurations and details are set forth to provide a thorough understanding of the present invention. However, it will also be apparent to one skilled in the art that the present invention can be practiced without the specific details presented herein. Furthermore, well-known features may be omitted or simplified so as not to obscure the present invention.

[0019] For example, and not intended to limit certain embodiments of the present invention, discussions utilizing terms such as "processing," "operating," "calculating," "determining," "establishing," "analyzing," "checking," or the like, may refer to operations and / or processes of a computer, computing platform, computing system, or other electronic computing device that manipulates data represented as physical quantities (e.g., electronic quantities) in the computer's registers and / or memory, or transforms it into other data similarly represented as physical quantities in the computer's registers and / or memory, or in other information transitory or non-transitory or processor-readable storage media that may store instructions that, when executed by a processor, cause the processor to perform an operation and / or process. For example, and not intended to limit certain embodiments of the present invention, the terms "plurality" and "a plurality," as used herein, may include, for example, "multiple" or "two or more." Throughout this specification, the terms "plurality" or "a plurality" may be used to describe two or more components, devices, elements, units, parameters, or the like. The term "set," as used herein, may include one or more items, unless stated otherwise. Unless expressly stated, the method embodiments described herein are not constrained to a particular order or sequence. Furthermore, some of the method embodiments or elements thereof described may occur or be performed simultaneously, at the same time, or concurrently in an order different from that described.

[0020] Although this disclosure includes a detailed description of cloud computing, it should be understood that implementation of the teachings described herein is not limited to a cloud computing environment, but rather, embodiments of the invention may be implemented in connection with any other type of computing environment now known or later developed.

[0021] Cloud computing is a service delivery model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal administrative effort or interaction with the service provider. An example cloud model may include, for example, five characteristics, at least three service models, and at least four deployment models.

[0022] The characteristics can be, for example:

[0023] On-Demand Self-Service: Cloud customers can automatically and unilaterally provision computing capacity, such as server time and network storage, as needed, without human interaction with the service provider.

[0024] Pervasive Network Access: Functionality is available over the network and is accessed through standard mechanisms, facilitating use by heterogeneous thin- or thick-client platforms (e.g., cell phones, laptops, and PDAs).

[0025] Resource Pooling: The provider's computing resources are pooled using a multi-tenant model, with various physical and virtual resources dynamically allocated and reallocated according to demand to serve multiple consumers. Consumers have a sense of location independence in that they generally have no control or knowledge of the exact location of the resources provided, although they may be able to identify the location at a higher level of abstraction (e.g., country, state, or data center).

[0026] Rapid Elasticity: Capabilities can be rapidly provisioned and rapidly scaled out, and rapidly released and rapidly scaled in, quickly and elastically, sometimes automatically. To the consumer, the capabilities available for provisioning are often seemingly infinite and can be purchased in any quantity at any time.

[0027] Metering Services: Cloud systems automatically control and optimize resource usage by leveraging metering capabilities at a level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both providers and consumers of the services being utilized.

[0028] The service model could be for example:

[0029] Software as a Service (SaaS): The functionality offered to the consumer is the use of the provider's applications running on a cloud infrastructure. These applications are accessible from a variety of client devices through thin-client interfaces such as web browsers (e.g., web-based email). The consumer does not manage or control the underlying cloud infrastructure, which may include networks, servers, operating systems, storage, or even individual application functions, with the possible exception of application configuration settings specific to a limited number of users.

[0030] Platform as a Service (PaaS): The functionality offered to the Customer is the deployment of applications created or acquired by the Customer using programming languages ​​and tools supported by the Provider onto a cloud infrastructure, including the underlying cloud infrastructure including networks, servers, operating systems, or storage, which the Customer does not manage or control, although the Customer may control the deployed applications and, in some cases, the configuration of the hosting environment for the applications.

[0031] Infrastructure as a Service (IaaS): The functionality provided to the customer is the provisioning of processing, storage, networking, and other basic computing resources onto which the customer can deploy and run any software, which may include operating systems and applications. The customer does not manage or control the underlying cloud infrastructure, but does have control over the operating systems, storage, deployed applications, and in some cases, limited control over selected networking components (e.g., host firewalls).

[0032] Database as a Service (DBaaS): The functionality offered to the consumer is the storage of data on a cloud infrastructure. The DBaaS paradigm is a common approach to storing data in cloud-based computing services, where users can access the data without having to manage any hardware or software.

[0033] The deployment model can be, for example:

[0034] Private Cloud: The cloud infrastructure is hosted solely for an organization. It may be managed by that organization or a third party and may exist on or off premises.

[0035] Community Cloud: This cloud infrastructure is shared by several organizations to support a specific community with common interests (e.g., mission, security requirements, policies, and compliance considerations). It may be managed by those organizations or by a third party and may exist on or off premises.

[0036] Public Cloud: The cloud infrastructure is available to the general public or large industry groups and is owned by organizations that sell cloud services.

[0037] Hybrid Cloud: This cloud infrastructure is a composite of two or more clouds (private, community, or public) that remain their own entities but are bound together by standardized or proprietary technologies that allow data and application portability (e.g. cloud bursting for load balancing between clouds).

[0038] A cloud computing environment is a service oriented environment with a focus on statelessness, low coupling, modularity, and semantic interoperability. At the heart of cloud computing is an infrastructure that includes a network of interconnected nodes.

[0039] Embodiments of the present invention may provide systems and methods for dynamic whitelisting, or for dynamically determining the trust level of a computer database connection. According to embodiments of the present invention, messages associated with trusted end-to-end links (e.g., the bodies or payloads of database requests and responses) need not be subjected to comprehensive security analysis.

[0040] The current architecture of DAM and FAM products is based on a two-step process. The first step is performed in real time by an agent software or application installed on the data source machine, and the second step is performed offline by a security server application, also called the collector. The data source machine may include a database, for example a database server, a file server, or a combination of a database and a proxy or network gate for the database. The agent software may be installed on the database itself or on the proxy or network gate for the database. By installing the agent software on the proxy or network gate for the database, it may be possible to capture data packets, also called data records, in a cloud-based database (when the DBaaS model is used) operated many times by a third party that does not allow the installation of software applications on that database.

[0041] According to the prior art application, the agent application may capture or receive all data packets including requests and responses of the monitored database, read the header information, perform initial rule processing on the header information, and then send the data packets to the collector application for offline comprehensive security analysis. The comprehensive security analysis performed by the collector may include obtaining or receiving the data packets from the agent, parsing the data packets, structuring the data, for example classifying the data and mapping metadata to the data, building a data hierarchy, applying policy rules to the classified data to identify sensitive data, and detecting data leakage or data tampering according to rule matching. The collector may then send the data for further analysis and auditing by other components.

[0042] Many of the processes for comprehensive security analysis performed by collectors utilize data mapping and classification, which is typically performed offline due to the complexity and performance requirements of mapping and classifying huge amounts of data (e.g., +100,000 TPS per data source or 100 million TPS in total). Agents must not delay transactions and must avoid latency. Sniffing and analyzing such huge amounts of data in real time or near real time requires appropriate computational infrastructure, which can be very expensive.

[0043] One technique for reducing the amount of data analyzed is whitelisting, which may involve determining a trust level or other rating for end-to-end links without performing a comprehensive security analysis on the requests and responses of trusted end-to-end links and performing a comprehensive security analysis on the requests and responses of untrusted end-to-end links.

[0044] Existing solutions for whitelisting may involve tagging or labeling end-to-end links as trusted or untrusted using techniques such as User Behavior Analytics applications (UBA), risk assessment, signature searches, and trusted connections. However, these techniques are all static, i.e., once a connection is classified as trusted, the entire volume of communication in this connection is considered trusted. Therefore, these techniques are subject to attacks such as hijacking, where an attacker takes over a portion of the connection and acts as one of the participants.

[0045] Embodiments of the present invention may improve the art of security analysis by providing a method for whitelisting or for determining the trust level or reputation of an end-to-end link that is dynamic (e.g., performed periodically during run-time) and at the same time requires fewer computational resources (compared to a full analysis of the communications). An embodiment of the method for determining the trust level of an end-to-end link may be performed periodically in real-time or near real-time, which may allow for the detection of anomalous behavior of communications on an end-to-end link that has already been determined to be trusted. Thus, a hijacking attack in which an attacker takes over a portion of an end-to-end link that has already been classified as trusted may be detected, assuming that the hijacker may behave differently than normal users of the end-to-end link.

[0046] A database connection may be a software construct that may enable a client application or software to communicate with a data source machine, e.g., send commands and receive replies. In many applications, connections are pooled to facilitate reuse of connections. Thus, multiple users may use multiple connections jointly. According to an embodiment of the invention, an end-to-end link may represent communication between a single client and a single database. The link may be carried over to multiple connections in one or more connection pools.

[0047] According to an embodiment of the present invention, an end-to-end link may be defined by a tuple, or combination, of parameters associated with a request sent to a database or a response from a database that specifies the end-to-end link. The tuple may include parameters that associate the request or response with a single user. These parameters may be taken from the headers of the request or response. Ideally, the end-to-end link may be unique to a single user, or at least as close as possible to a single user based on the available parameters. The tuple of parameters may include user information, source program information, and database information. The user information may include parameters that identify the user himself. For example, the user information parameters may include one or more of a database user identification (DB User), an operating system user identification (OS User), an application user identification (App User), and a client host address (ClientHost). The source program information may include parameters that identify the application or software used to connect the user to the database, e.g., SQLplus, Java® Database Connectivity (JDBC), etc. The database information may include parameters that identify the database. For example, the database information may include one of the name of the database (DbName) or the service name (ServiceName), and one of the database server hostname (ServerHostName) or the database server IP. Other user information parameters, source program information parameters, database information parameters, or other parameters may be used.

[0048] The use of a tuple rather than just the database user identity (DB User) to specify an end-to-end link may allow the definition of a single end-to-end link used by a single user, for example, in situations where multiple users share the same connection or connection pool, which is very common in many applications, for example multiple bank tellers using a single connection to access the same database.

[0049] According to embodiments of the present invention, a signature of the end-to-end link may be generated. The signature may be generated based on messages associated with the end-to-end link that may represent normal behavior of the end-to-end link. In some embodiments, the signature may include or be generated from a compressed or reduced-size version of the message that does not include the value field and / or the command used in the end-to-end link. According to some embodiments of the present invention, the end-to-end link may be divided into groups or clusters of similar end-to-end links, for example by a classifier or by performing a clustering analysis on the signatures. Each cluster may include a group of end-to-end links with a small distance between the signatures of the end-to-end links in the cluster. Once the signatures are created, communications associated with the end-to-end link may be checked periodically by comparing the communications over the end-to-end link to the signatures or to the clusters of signatures. The trust level of the end-to-end link can be determined based on this comparison.

[0050] In some embodiments, the signature is generated by creating a construct for each message (not including the value field) of the set of messages of the end-to-end link and creating a feature histogram from the construct, in which case the signature may be or may include the feature histogram. For example, the construct may include a hash, or other compressed version, of the message that does not include the value field of the message. Removing the value field of the message before compressing the message may increase the uniformity of the compressed value. The operations used to generate the constructs, in some embodiments, may reduce the number of bits, may be very fast to compute, and may minimize collisions (which may occur when the same construct is generated for different messages). To generate the feature histogram from the constructs, the constructs may be divided into bins. It is assumed that the majority of messages (not including the value field) are similar during normal operation of the end-to-end link, and therefore hashing the messages that do not include the value field may generate a representative feature histogram.

[0051] In some embodiments, the feature histogram may also include commands of the set of messages of the end-to-end link. For example, the feature histogram may be generated by grouping the commands into command group bins. For example, the command group may include Data Definition Language commands (DDL), Data Manipulation Language commands (DML), Data Query Language commands (DQI), Data Control Language commands (DCL), Transaction Control Language commands (TCL), etc. It is assumed that during normal operation of the end-to-end link, the majority of the commands will repeat themselves, and thus counting the number of commands in each command group may generate a representative command histogram to be included in the feature histogram. Thus, according to some embodiments, the signature of the end-to-end link may include a feature histogram that includes constructs and / or command bins.

[0052] In many database applications, the same actions are repeated by the same user and by other users with the same role. For example, all users who are retail bankers in a bank may repeat the same actions many times during the day. For example, such employees may perform transactions such as money transfers, loan approvals, current accounts of many customers, etc., where each transaction may be performed by hundreds of SQL statements. In this case, according to an embodiment of the present invention, removing values ​​from messages may reveal the common actions that are repeated. Thus, as long as the same user uses the end-to-end link for the same purpose, the overall shape of the feature histogram may remain the same. In contrast, large deviations in the overall shape of the feature histogram may serve as an indicator of a possible security problem.

[0053] Referring now to FIG. 1, an exemplary cloud computing environment 50 is depicted. As shown, the cloud computing environment 50 includes one or more cloud computing nodes 10 with which local computing devices used by cloud users, such as a personal digital assistant (PDA) or cell phone 54A, a desktop computer 54B, a laptop computer 54C, or an automobile computer system 54N, or combinations thereof, can communicate. The nodes 10 may communicate with each other. They may be physically or virtually grouped in one or more networks, such as a private, community, public, or hybrid cloud, or combinations thereof, as described herein above (not shown). This enables the cloud computing environment 50 to provide infrastructure, platform, and / or software as a service without the cloud user having to maintain resources on a local computing device. Cloud computing environments are typically located remotely from their users. It will be understood that the several types of computing devices 54A-54N shown in FIG. 1 are intended to be merely illustrative, and that the computing nodes 10 and cloud computing environment 50 can communicate with any type of computerized device via any type of network and / or network-addressable connections (e.g., using a web browser).

[0054] Referring now to Figure 2, a set of functional abstraction layers provided by cloud computing environment 50 (Figure 1) is shown. It should be understood in advance that the components, layers, and functions shown in Figure 2 are intended to be merely illustrative, and that embodiments of the present invention are not limited thereto. As depicted, the following layers and corresponding functions are provided:

[0055] Hardware and software layer 60 includes hardware and software components, such as those depicted in Figure 10. Examples of hardware components include processors (e.g., processor 705 depicted in Figure 10), such as mainframe 61, RISC (reduced instruction set computer) architecture based server 62, server 63, and blade server 64, storage devices 65 (e.g., storage device 730 depicted in Figure 10), and networks and networking components 66. In some embodiments, software components include network application server software 67 and database software 68.

[0056] The virtualization layer 70 provides an abstraction layer that may provide examples of the following virtual entities: virtual servers 71 , virtual storage 72 , virtual networks including virtual private networks 73 , virtual applications and operating systems 74 , and virtual clients 75 .

[0057] According to some embodiments, the monitored database may be implemented on virtual storage 72 and physically located on storage device 65. The database may be managed by database software 68, which may include agent software according to embodiments of the present invention. Collectors or data security applications may be implemented by software running on virtual servers 71, although other architectures and hardware may be used.

[0058] In one example, management layer 80 may provide the example functions described below: Resource provisioning 81 provides dynamic procurement of computing and other resources utilized to execute tasks within the cloud computing environment. Metering and pricing 82 provides cost tracking as resources are utilized within the cloud computing environment and billing or invoicing for the consumption of these resources. In one example, these resources may include application software licenses. Security provides identity verification for cloud consumers and tasks, and protection of data and other resources. User portal 83 provides consumers and system administrators with access to the cloud computing environment. Service level management 84 provides allocation and management of cloud computing resources such that required service levels are met. Service level agreement (SLA) planning and fulfillment 85 provides proactive coordination and procurement of cloud computing resources anticipated to be needed in the future by SLAs.

[0059] The workload tier 90 provides examples of functionality for which cloud computing environments are utilized. Examples of workloads and functions provided from this tier include mapping and navigation 91, software development and lifecycle management 92, virtual classroom instructional delivery 93, data analytics processing 94, and transaction processing 95.

[0060] Please refer to Fig. 3, which illustrates a system 300 according to an embodiment of the present invention. According to some embodiments, the security server 330 is implemented on a virtual server 71, and the data source machine 320 is implemented on a virtual storage 72, although other implementations may be applied. It should be understood in advance that the components and functions illustrated in Fig. 3 are intended to be merely exemplary, and the embodiments of the present invention are not limited thereto.

[0061] Network 340 may include any type of network or combination of networks available to support communications between database client 310, data source machine 320, and security server 330. Network 340 may include, for example, wired, wireless, fiber optic, or any other type of connection, local area network (LAN), wide area network (WAN), Internet and intranet networks, etc. Additionally or alternatively, any of database client 310, data source machine 320, and security server 330 may be directly connected to one another.

[0062] According to some embodiments, a database client application 312 executing on a database client 310 may communicate with a data source machine 320, for example, by generating and submitting data packets or data records 350, including, for example, database queries, to the data source machine 320. The data packets may be associated with an end-to-end link 360.

[0063] In one example, a query transmitted from database client 310 to data source machine 320 may be or may be contained within one or more database protocol packets, also referred to as data packets 350, which include a header 352 and a payload 354. Header 352 may include metadata such as machine information, network information, user information, client information, etc. For example, the header may include the following parameters used to define end-to-end link 360: ServerHostName, ServiceName, DbName, ClientHost, OsUser, DbUser, etc. Payload 354 may include data or statements related to the database query, such as SQL requests or responses, or both. Although FIG. 3 shows a single database client 310 and a single data source machine 320, one or more data source machines 320 may provide database services to one or more database clients 310 or client applications 312.

[0064] In one example, payload 354 of data packet 350 may include a query (e.g., a request or SQL statement) or a response to a query, which are referred to collectively herein as message 510 (depicted in FIG. 5). The query may include a Structured Query Language (SQL) statement for accessing data in a table managed by a database management application (e.g., database management application 324, or database software 68, or both). SQL represents a standardized language for defining and manipulating data in a relational database. For example, in the relational database model, a database is recognized as a set of tables containing data, and data may be retrieved by using SQL statements to specify result tables derived from one or more tables. The query may be defined in one or more additional or alternative languages ​​or protocols for defining and manipulating data in relational databases or other types of databases.

[0065] The data source machine 320 may include a database 326, e.g., a database server, a file server, etc., or a combination of the database 326 and a proxy or network gateway for the database 326, a database management application 324, and an agent application 322. An example of a data source machine including a database server 410 is depicted in FIG. 4A. The database server 410 may include a database 326 managed by a database management application 324 that may include or communicate with the agent application 322. A similar architecture may be applied to a file server. FIG. 4B depicts a data source machine including a combination of a gateway, network gateway, or proxy 422 and a database server (or file server) 420. The database server 420 may include a database 326 managed by the database management application 324. In this embodiment, the agent application 322 is located at the gateway, network gateway, or proxy 422.

[0066] In one example, in response to a query from a database client 310, the database management application 324 may address the query and generate a response to the query, which is returned to the database client 310 in a database server response.

[0067] Data packets 350 may be streamed between database client 310 and data source machine 320 over end-to-end link 360. Agent 322 may be a computer-implemented process that may capture, sniff, or intercept one or more data packets 350 along the communication stream between database client 310 and data source machine 320 without interfering with the communication of data packets 350 to data source machine 320. Agent 322 may be implemented at one or more points along the communication stream between database client application 312 and data source machine 320 to monitor for and capture or intercept data packets 350 without the involvement of database management application 324 (or database software 68) or relying on any form of native auditing or native logging of database management application 324. Although depicted as part of data source machine 320, agent 322 may intercept data packets 350 elsewhere, such as, but not limited to, in database memory of database servers 410 and 420, within network 340, at the operating system level, or at the database library level.

[0068] An end-to-end link 360 may be defined by a tuple or combination of parameters associated with a data packet 350 (typically found in a header 352). A tuple may include one or more of the following: user information parameters, such as OsUser, DbUser, App User, ClientHost (e.g., associated with a database client 310), source program information, and database information, such as ServiceName or DbName and ServerHostName or database server IP (e.g., associated with a database 326). For example, in a situation where multiple users use or share a single connection or connection pool, it may be necessary to specify the end-to-end link 360 using a tuple rather than just the user name (DB User) to identify the end-to-end link 360 within the connection or connection pool.

[0069] According to an embodiment of the present invention, agent 322 may capture or intercept a plurality of data packets 350 flowing between data source machine 320 and data client 310. Agent 322 may capture both data packets 350 including query packets sent from data source machine 320 to data client 310 and data packets 350 including response packets sent from data client 310 to data source machine 320. Data packets 350 may be captured in real time without substantially adding latency or delay.

[0070] According to some embodiments, the agent 322 may decode the captured data packets 350 to obtain a header 352 of each data packet 350. The agent 322 may analyze the header 352 to obtain the header information and to associate the packet with an end-to-end link 360 based on the header information. According to some embodiments of the invention, the end-to-end link 360 may be associated with a trust level, a security state, or a security grade or rating. According to embodiments of the invention, the agent 322 may associate each data packet 350 with a security state or trust level of the end-to-end link 360 with which it is associated. The trust level may be a categorical parameter, which may be, for example, either "trusted" or "not trusted". Other trust levels or ratings may be used.

[0071] In some embodiments, the agent 322 may apply policy rules to subsequent messages of the untrusted end-to-end link 360. According to embodiments of the present invention, the agent 322 may determine whether the data packet 350 needs to be sent to the security server 330 based on or according to the trust level. The trusted end-to-end link 360 may be placed in a whitelist, and the message 510 associated with the trusted end-to-end link 360 may be ignored, e.g., excluded from further security analysis, in particular from a comprehensive security analysis performed by the security server 330. In this case, the agent 322 may not send the message 510 associated with the trusted end-to-end link 360 to the security server 330. On the other hand, if the end-to-end link 360 is categorized as untrusted, the message 510 associated with the (untrusted) end-to-end link 360 may be sent by the agent 322 to the security server 330 to undergo a comprehensive security analysis. In some embodiments, if the end-to-end link 360 is categorized as untrusted, the agent 322 may issue an alert. In accordance with embodiments of the present invention, other security measures may be employed if the end-to-end link 360 is categorized as untrusted. Of course, it will be readily appreciated that a single end-to-end link 360, as disclosed herein, may be categorized as trusted in some instances and untrusted in other instances.

[0072] Thus, upon capturing a data packet 350, the agent 322 may decode the header 352 to obtain header information, also referred to as metadata, including, for example, machine information, network information, user information, client information, etc. Based on the header information, the agent 322 may determine an end-to-end link 360 associated with the data packet 350. Once the end-to-end link 360 is known, the agent 322 may verify the security state associated with the end-to-end link 360 and act accordingly. Based on the security state, the agent 322 may determine whether the message 510 associated with the header 352 should be blocked, whether it should be allowed to flow without further analysis, or whether further security analysis is required. For example, a header security rule may specify that a message 510 from a particular end-to-end link 360 shall be blocked if the user is known to be a malicious entity, shall be allowed to flow (e.g., ignored) without further analysis if the end-to-end link 360 is trusted, or shall be further analyzed if the status of the end-to-end link 360 is untrusted. Other header security rules or combinations of header security rules may be used. Because the header structure is known, decoding and analysis of the header 352 may be performed in real time without introducing significant delays.

[0073] According to an embodiment of the present invention, the agent 322 may generate a signature 362 for the end-to-end link 360. The agent 322 may generate the signature 362 based on messages 510 transmitted over the end-to-end link 360 and captured by the agent 322, for example, in a preparation phase and during an operational phase as disclosed herein. In this case, the signature 362 may represent normal behavior of the end-to-end link 360. To generate the signature 362, the agent 322 may capture messages 510 over a time window of the preparation phase (also called a training phase) or until a sufficient number of messages 510 have been captured. For example, in a typical application, approximately 150,000 to 400,000 messages 510 may be required to generate the signature 362. In some embodiments, the preparation phase may include multiple sessions (a session may refer to a logical representation of a connection to a database from login to logout). In some embodiments, agent 322 may capture messages 510 during the first one or two minutes of 20-40 sessions to generate signature 362. Other time windows for capturing messages for generating signature 362 may be used. According to embodiments of the invention, agent 322 may generate signature 362 for end-to-end links 360 that have a high volume or high rate of messages 510. For example, agent 322 may not generate signatures for sessions that have a message rate below a threshold, e.g., less than 100 messages per second.

[0074] In some embodiments, all messages 510 used to generate signatures 362 may be subjected to comprehensive security analysis as disclosed herein or otherwise examined to verify that they represent normal behavior of the end-to-end link 360.

[0075] The signature 362 may include a compressed or reduced-size version of the message 510 that does not include the value fields captured during the preparation stage. Once the signature 362 is created, the agent 322 may periodically check communications over the end-to-end link 360 by comparing the messages 510 of the end-to-end link 360 to the signature 362. Based on the comparison, the agent 322 may calculate or determine a trust level for the end-to-end link 360. According to some embodiments, the preparation stage and generation of the signature 362 may be repeated periodically, for example, once a week or once a year.

[0076] According to some embodiments, the signature 362 may include a feature histogram associated with the message 510 transmitted over the end-to-end link 360 during the preparation stage. The histogram generated during the preparation stage may be referred to herein as a feature histogram of the end-to-end link 360. In this case, the comparison may be made by sampling the message 510 over a time window during the operation stage, generating a work histogram, and comparing the work histogram to the feature histogram as disclosed herein.

[0077] Reference is now made to FIG. 5, which illustrates a histogram 540 of messages 510, skeletons 520, constructs 530, and end-to-end links 360, according to an embodiment of the present invention. The histogram 540 may represent either a feature histogram or a work histogram. For example, to generate a feature histogram (e.g., signature 362), the agent 322 may capture messages 510 during a training or preparation stage, and to generate a work histogram, the agent 322 may capture messages 510 during a run-time or operation stage.

[0078] In some embodiments, agent 322 may generate histogram 540 by generating skeletons 520 from each message 510 used to generate histogram 540, constructs 530 from each skeleton 520, and histogram 540 from the constructs 530. Histogram 540 may be (or may be a portion of) signatures 362 of end-to-end links 360 for messages captured during the preparation stage and work histograms for messages captured during the run-time or operation stage.

[0079] Agent 322 may generate skeleton 520 from message 510 by removing values ​​from message 510. The values ​​may be or may reference specific data elements stored in a database table. In this case, skeleton 520 may include message 510 but not the value field. An example SQL statement is shown below: Example 1: Select NAME from EMPLOYEE where DEPARTMENT=”SALE” and BAND>8; Example 2: SELECT FULL_NAME, ADDRESS from CUSTOMER, PHONE where PHONE.PHONE_NO like “01230123012%” and CUSTOMER.CUSTOMER_ID=PHONE.CUSTOMER_ID;

[0080] In example 1, the values ​​are "SALE" and "8", and in example 2, the value is the phone number "01230123012". These examples are for requests. Responses typically include column headings and values. In this case, the values ​​may be removed to generate a skeleton 520 from the response, which may include the column headings.

[0081] Agent 322 may generate constructs 530 from skeletons 520 by hashing skeletons 520 or using other compression methods. The operations used to generate constructs 530 may reduce the number of bits in message 510, may be very fast to compute, and may minimize collisions, e.g., in some cases may not generate or nearly generate the same constructs 350 for different skeletons 520. In typical applications, skeletons 520 may range in length from a few dozen characters up to several thousand characters for complex sentences. A hash of a skeleton 520 may be up to about 15-25 characters.

[0082] To generate the feature histogram 540, the agent 322 may divide the values ​​of the constructs 530 into a series of intervals, typically contiguous, adjacent, and non-overlapping, where each interval may be referred to as a bin or bucket. The agent 322 may then count how many constructs 530 fall within each bin. The bins may or may not be of equal size. It is assumed that the messages 510 of the end-to-end link 360 may be repeats of themselves or may be similar to each other, especially when values ​​are removed. In this case, generating the feature histogram 540 based on the skeleton 520 of the messages 510 may represent the common behavior of the end-to-end link 360. Thus, it may be expected that the distribution of the messages 510 of the end-to-end link 360 will remain similar to the feature histogram.

[0083] According to some embodiments, histogram 540 may include commands used in message 510 in addition to or as an alternative to construct 530. For example, agent 322 may divide commands 550 included in message 510 into command groups. For example, command groups may include DDL, DML, DQI, DCL, TCL, etc. In this case, each command group may be a bin in histogram 540, and agent 322 may place each command in the appropriate bin based on the type of command.

[0084] According to an embodiment of the present invention, during the operational phase, as long as the end-to-end link 360 is labeled or classified as trustworthy, the agent 322 may not send messages 350 associated with the end-to-end link 360 to the security server 330 for comprehensive security analysis. This may dramatically reduce the computational power required at the security server 330. However, to detect hijacking attacks, the agent 322 may sample messages 510 associated with the end-to-end link 360 from time to time, e.g., periodically, e.g., every 10-30 minutes, or for each new session, or a combination thereof, and check for differences from a signature, e.g., a feature histogram. According to an embodiment of the present invention, the agent 322 may sample messages 510 of the end-to-end link 360 and check for differences from the signature 362 only in sessions having a high volume or rate of messages 510. For example, agent 322 may not check signature messages for sessions that have a message rate below a threshold, such as less than 100 messages per second, and instead, messages 510 for those sessions may be subjected to a comprehensive security analysis because they do not contain large amounts of data and therefore do not pose a high load on the system.

[0085] For example, agent 322 may sample messages 510 associated with end-to-end link 360 during a sampling time window. The sampling time window may be of a fixed length (e.g., 1-2 minutes) or may continue until a sufficient number of messages 510 have been sampled (e.g., 100-400 messages). According to an embodiment of the invention, agent 322 may generate a work histogram 540 from sampled messages 350 as disclosed herein.

[0086] Reference is now made to FIG. 6A, which illustrates a comparison of a work histogram 610 of an end-to-end link 360 and a feature histogram 620 of the end-to-end link 360, according to an embodiment of the present invention. In FIG. 6A, the feature histogram 620 is generated in a preparation stage and the work histogram 610 is generated during an operational stage, as disclosed herein. According to an embodiment of the present invention, the agent 322 may compare 602 the work histogram 610 to the feature histogram 620 to determine a trust level 604 of the end-to-end link 360. In some embodiments, the agent 322 may determine the trust level 604 directly from the comparison 602, and in some embodiments, the agent 322 may calculate a security grade based on the comparison 602 and may determine the trust level 604 by comparing the security grade to a threshold. The comparison 602 may be performed using any applicable statistical or other method. For example, agent 322 may compare 602 the variance of work histogram 610 to the variance of feature histogram 620. For example, agent 322 may determine that end-to-end link 360 may remain reliable if, for example, the following is true, and that end-to-end link 360 is classified as unreliable if the following is not true (other rules may be used): work_histogram_variance < 2* characteristic_histogram_variance (Equation 1)

[0087] Reference is now made to Figure 6B, which illustrates a comparison 606 of a work histogram 610 of an end-to-end link 360 with a plurality of feature histograms 620, 622, 624 of a plurality of end-to-end links 360, 362, 364 each associated with a cluster 630 of end-to-end links 360, 362, 364, according to an embodiment of the present invention. Although the cluster 630 is illustrated as including three end-to-end links 360, 362, 364, this is by way of example only and the cluster 630 may include any number of end-to-end links.

[0088] The agent 322 may find clusters 630 of end-to-end links 360, 362, 364 where features used for clustering may include, for example, the constructs of the end-to-end links 360, 362, 364, or the commands used in the end-to-end links 360, 362, 364, or both. For example, the commands used in the end-to-end links 360, 362, 364 may be grouped into command groups, e.g., DDL, DML, DQI, DCL, TCL, etc. A clustering algorithm may be used to find clusters that each include similar end-to-end links, e.g., end-to-end links that have common constructs and commands. In some embodiments, a k-means method may be used to partition the end-to-end links 360 into k clusters 630, with each end-to-end link 360 belonging to the cluster 630 with the closest mean value. Other clustering methods may be used.

[0089] In some embodiments, the agent 322 may compare 606 the work histogram 610 to each of the feature histograms 620, 622, and 624 of the cluster 630 of the end-to-end link 360 (e.g., using Equation 1) to determine a trust level 604 for the end-to-end link 360. For example, to consider the end-to-end link 360 as trusted, Equation 1 should in some embodiments be true for all feature histograms 620, 622, and 624, and to consider the end-to-end link 360 as untrustworthy, it may be sufficient for Equation 1 to cease to be true for one of the feature histograms 620, 622, and 624. Other rules and conditions may be used to determine the trust level of the end-to-end link 360.

[0090] Reference is now made to FIG. 6C , which illustrates a comparison 608 of a work histogram 610 of an end-to-end link 360 to a common feature histogram 640 of a cluster 630 of end-to-end links 360, 362, 364, according to an embodiment of the present invention. In some embodiments, a common feature histogram 640 may be generated that is common to all end-to-end links of the cluster 630, and the work histogram 610 of the end-to-end link 360 may be compared 608 against the common feature histogram 640 (e.g., similar to comparison 602) to determine a trust level for the end-to-end link 360.

[0091] According to embodiments of the present invention, the calculation of the trust level of the end-to-end link 360 should be fast so as to allow real-time operation. This requirement is achieved by embodiments of the present invention because the computation of hash values ​​and the comparison of histograms require fewer computational resources. Dynamic whitelisting according to embodiments of the present invention may dynamically reduce the computational power required to perform a comprehensive security analysis.

[0092] Returning to FIGURE 3, in accordance with an embodiment of the present invention, agent 322 may send data packets 350 for end-to-end link 360 to security server 330 if the trust level of end-to-end link 360 changes from trusted to untrusted. Additionally or alternatively, agent 322 may issue a security alert if the trust level of end-to-end link 360 changes from trusted to untrusted. Additionally or alternatively, agent 322 may block data packets 350 for end-to-end link 360 if the trust level of end-to-end link 360 changes from trusted to untrusted.

[0093] The security server 330 may implement or execute a data security application 332. The data security application 332 may be or may include a firewall, a DAM and / or a FAM, an external database non-intrusive security mechanism (EDSM), enterprise database auditing, and real-time protection. The data security application 332 may provide database activity monitoring services for the data source machine 320, including performing comprehensive security analysis. The data security application 332 may provide continuous monitoring of database activity for the data source machine 320. An example of the data security application 332 may include, but is not limited to, the Guardium® application available from International Business Machines Corporation.

[0094] According to an embodiment of the present invention, the data security application 332 may receive or obtain a data packet 350. A comprehensive security analysis may include parsing the data packet, mapping metadata to data, building a hierarchy of the data (e.g., building a name-value hierarchical tree), and processing policy rules. Processing a policy rule may require an associated name and value. For example, a rule may include "if a name and value like %ID% matches a certain regular expression (Regex)", or a rule may assume a zip code and a street name.

[0095] According to some embodiments, the data security application 332 may extract a database query or a response to a database query from the intercepted message 510, parse the extracted database query or response, and create a security structure according to database protocol rules. The rules may include, but are not limited to, the type of action or command identified in the query, the database object that will be acted upon by the action, and the user identifier of the user requesting the query, an identifier for the service IP address, client IP address, client MAC, the network protocol used to access the data, the database type, the service name for the name of the service providing the data, the name of the database being accessed, the source application, application user name, and operating system user used to access the data, database related fields, error codes, exception types, the service IP address of the location of the data being accessed, and additional or alternative rules.

[0096] According to some embodiments, the data security application 332 may validate possible database object access violations in the security structure against the security policy defined by the policy rule. In one example, if the validity of the security structure is not validated against the security policy, the data security application 332 may issue an alert to an administrator or other entity indicating that the validity of the intercepted data packet 350 was not validated against the security rule. In one example, an administrator or service may configure each of the rules. According to some embodiments, a security rule may include one or more settings, such as, but not limited to, an action type setting that specifies the type of action that is or is not permitted to be accessed, an object setting that specifies one or more particular database objects on which the action acts, and a user setting that specifies one or more user identifiers for a user requesting an action on a database object. For example, actions constrained by a security rule may include actions such as, but not limited to, create, select, update, and delete. A security setting may include additional or alternative types of settings.

[0097] Each of the database client 310, the security server 330, and the data server 420 may be or include a computing device, such as the computing device 700 depicted in Figure 6. The one or more databases 326 may be or include a storage device, such as the storage device 730.

[0098] Reference is now made to Figure 7, which is a flow chart of a method for associating a message with an end-to-end link according to an embodiment of the present invention. One embodiment of a method for associating a message with an end-to-end link may be performed, for example, by the systems shown in Figures 1, 2, 3, 4, and 9. The process of associating a message with an end-to-end link may be repeated for multiple data packets flowing between the data source machine and the data client.

[0099] At operation 742, a data packet (e.g., data packet 350) may be captured. The data packet may include a header 352 and a payload 354 that includes a query sent by a data client to a database or a database response to the query (e.g., message 510). For example, an agent software instance located and executing on a data source machine (e.g., a database server or a proxy or network gateway for a database server) may capture the data packet. At operation 744, the agent 322 may decode the data packet to obtain the header and message of the data packet. The agent 322 may analyze the header to obtain parameters of the end-to-end link, e.g., ServerHostName, ServiceName, DbName, ClientHost, OsUser, DbUser, etc. At operation 746, the agent 322 may analyze the header as disclosed herein, e.g., based on parameters extracted from the header, to associate the packet with an end-to-end link.

[0100] Please refer to FIG. 8, which is a flow chart of a method for generating a feature histogram according to an embodiment of the present invention. An embodiment of the method for generating a feature histogram may be implemented, for example, by the systems shown in FIG. 1, FIG. 2, FIG. 3, FIG. 4, and FIG. 9. An embodiment of the method for generating a feature histogram may be implemented, for example, in a training or preparation stage. According to some embodiments, the generation of the feature histogram may be repeated periodically, for example, once a week or once a month, to keep the feature histogram up to date. An embodiment of the method for generating a feature histogram may be implemented for an end-to-end link 360 having a high volume or rate of messages, for example, more than 100 messages per second.

[0101] In operation 750, agent 322 may capture a set of messages for a single end-to-end link. The set of messages may include a predetermined number of messages or messages captured over a predetermined time window. For example, in a typical application, agent 322 may capture approximately 150,000-400,000 messages for a single end-to-end link in operation 750. In some embodiments, agent 322 may capture messages in multiple sessions for a single end-to-end link. In some embodiments, agent 322 may capture messages during the first one or two minutes of 20-40 sessions for a single end-to-end link in operation 750. Other time windows for capturing messages for generating a signature may be used. In operation 752, agent 322 may generate a skeleton from each of the messages. The skeleton may include message text other than value fields. In operation 754, agent 322 may generate a construct, or a condensed form, of each skeleton. For example, agent 322 may hash the skeleton to obtain the constructs. In operation 755, agent 322 may extract commands from each of the messages. In operation 756, agent 322 may generate feature histograms for the end-to-end links. For example, agent 322 may generate feature histograms from the constructs as disclosed herein. Additionally or alternatively, agent 322 may generate feature histograms from the commands of the messages by splitting the commands into command groups as disclosed herein. Operations 750-756 may be repeated for a plurality of end-to-end links such that a feature histogram is generated for each of the plurality of end-to-end links. In operation 758, agent 322 may cluster or classify the end-to-end links such that a cluster of end-to-end links is obtained.In some embodiments, the clustering or classification may be performed based on the constructs and commands of the end-to-end links as disclosed herein. In some embodiments, the agent 322 may generate a feature histogram for a cluster of end-to-end links. In some embodiments, the agent 322 may generate a feature histogram for each of a plurality of end-to-end links in the cluster.

[0102] Please refer to FIG. 9, which is a flow chart of a method for dynamically determining a trust level of an end-to-end link of a computer database, according to an embodiment of the present invention. An embodiment of a method for dynamically determining a trust level of an end-to-end link may be implemented, for example, by the systems shown in FIG. 1, FIG. 2, FIG. 3, FIG. 4, and FIG. 9. The process for determining the trust level of an end-to-end link of a computer database may be repeated periodically and / or for each new session. An embodiment of a method for dynamically determining a trust level of an end-to-end link may be implemented, for example, for end-to-end links having a high volume or a high rate of messages. For example, the agent 322 may not determine a trust level of an end-to-end link for sessions having a message rate below a threshold, for example, less than 100 messages per second. Instead, all messages of a session having a message rate below the threshold may be subjected to a comprehensive security analysis.

[0103] At operation 760, agent 322 may obtain a set of messages (also referred to as a second set of messages) for a single end-to-end link. The set of messages may include a predetermined number of messages (e.g., 100-400 messages) or messages obtained over a predetermined time window (1-2 minutes). At operation 762, agent 322 may generate a skeleton from each of the messages. The skeleton may include the message text other than the value field. At operation 764, agent 322 may generate a construct, or a condensed form of each skeleton. For example, agent 322 may hash the skeleton to obtain the construct. At operation 765, agent 322 may extract commands from each of the messages in the second set of messages. At operation 766, agent 322 may generate a work histogram for the end-to-end link. For example, agent 322 may generate a work histogram from the construct as disclosed herein. Additionally or alternatively, agent 322 may generate a work histogram from the commands of a message by dividing the commands into command groups as disclosed herein.

[0104] In operation 768, agent 322 may compare the work histogram to the feature histogram. In some embodiments, agent 322 may compare the work histogram to feature histograms of the same end-to-end link. In some embodiments, agent 322 may compare the work histogram to feature histograms of a cluster of end-to-end links to which the end-to-end link is associated. In some embodiments, agent 322 may compare the work histogram to each of a plurality of feature histograms of a cluster of end-to-end links to which the end-to-end link is associated.

[0105] In operation 770, agent 322 may determine a trust level of the end-to-end link. For example, agent 322 may determine a trust level of the end-to-end link based on the comparison. In some embodiments, agent 322 may compare the variance of the work histogram to the variance of the feature histogram and determine the trust level of the end-to-end link to be untrusted if the variance of the work histogram is greater than the feature histogram by a predetermined multiple, such as two times. Other rules may apply. Additionally or alternatively, agent 322 may determine the trust level of the end-to-end link to be untrusted if at least one of the constructs of the second set of messages is new. Agent 322 may determine a construct of the second set of messages to be new if the construct is not included in the feature histogram. In this case, according to some embodiments, for an end-to-end link to be considered or classified as untrusted, it is sufficient if the work histogram of the end-to-end link differs from the feature histogram of the end-to-end link or if at least one of the constructs of the second set of messages is new, even if the end-to-end link may otherwise be considered or classified as trusted.

[0106] According to some embodiments, if the end-to-end link is determined to be trusted, the agent 322 may not send messages of the end-to-end link to the security server 330 for comprehensive security analysis. According to some embodiments, the agent 322 may add constructs used to generate the work histogram to the feature histogram to keep the feature histogram up to date. According to some embodiments, if the end-to-end link is determined to be untrusted in operation 770, the agent 322 may apply policy rules to subsequent messages of the end-to-end link, and if the end-to-end link is trusted, the agent 322 may omit applying policy rules to subsequent messages of the end-to-end link. For example, the agent 322 may send messages of the end-to-end link to the security server 330 for comprehensive security analysis if the end-to-end link is untrusted. In operation 778, the agent 322 may issue a security alert if the end-to-end link is untrusted.

[0107] Figure 10 illustrates an exemplary computing device according to an embodiment of the present invention. Various components such as database client 310, security server 330, data source machine 320, database servers 410 and 420, gateway or proxy 422, agent application 322, and other modules may be, include, or be executed by computing device 700 or may include components as illustrated in Figure 10. For example, according to an embodiment of the present invention, a first computing device 700 having a first processor 705 may be used to classify data in real time for data streaming.

[0108] Computing device 700 may include a processor 705, which may be, for example, a central processing unit processor (CPU), chip, or any suitable computing or computing device, an operating system 715, memory 720, storage 730, input devices 735, and output devices 740. Processor 705 may be or may include one or more processors, co-located or distributed, and the like. Computing device 700 may be, for example, a workstation or personal computer, or may be implemented at least in part by one or more remote servers (e.g., in a "cloud"). For example, computing device 700 may be included in cloud computing environment 50 depicted in FIGS. 1 and 2.

[0109] The operating system 715 may be or include any code segment designed and / or configured to perform tasks including, for example, coordinating, scheduling, arbitrating, monitoring, controlling, or otherwise managing the operation of the computing device 700. The operating system 715 may be a commercially available operating system. The operating system 715 may be or include any code segment designed and / or configured to implement a virtual machine, e.g., emulation of a computer system. The memory 720 may be or include, for example, random access memory (RAM), read only memory (ROM), dynamic RAM (DRAM), synchronous DRAM (SD-RAM), double data rate (DDR) memory chips, flash memory, volatile memory, non-volatile memory, cache memory, buffers, short-term storage units, long-term storage units, or other suitable memory or storage units. The memory 720 may be or include multiple, possibly different, memory units.

[0110] The executable code 725 may be any executable code, such as an application, a program, a process, a task, or a script. The executable code 725 may be executed by the processor 705, which may be under the control of the operating system 715. For example, the executable code 725 may be or include software for dynamically determining a trust level of an end-to-end link of computer databases, according to an embodiment of the present invention. In some embodiments, more than one computing device 700 may be used. For example, multiple computing devices including components similar to those included in the computing device 700 may be connected to a network and used as a system.

[0111] Storage 730 may be or include, for example, a hard disk drive, a floppy disk drive, a compact disk (CD) drive, a CD recordable (CD-R) drive, a universal serial bus (USB) device, or other suitable removable and / or fixed storage unit. Storage 730 may include or store one or more databases, including database 326. In some embodiments, some of the components shown in FIG. 10 may be omitted. For example, memory 720 may be a non-volatile memory having the storage capacity of storage 730. Accordingly, although storage 730 is shown as a separate component, it may be embedded in or included within memory 720.

[0112] The input devices 735 may be or include a mouse, a keyboard, a touch screen or touch pad, or any suitable input device. It will be appreciated that any suitable number of input devices may be operatively connected to the computing device 700, as indicated by block 735. The output devices 740 may include one or more displays, speakers, or any other suitable output devices, or a combination thereof. It will be appreciated that any suitable number of output devices may be operatively connected to the computing device 700, as indicated by block 740. Any applicable input / output (I / O) devices may be connected to the computing device 700, as indicated by blocks 735 and 740. The input devices 735 and / or output devices 740 may include, for example, a wired or wireless network interface card (NIC), a modem, a printer, or a facsimile machine, a universal serial bus (USB) device, or an external hard drive. The network interface 750 may enable the device 700 to communicate with one or more other computers or networks. For example, the network interface 750 may include a Wi-Fi or Bluetooth device or connection, a connection to an intranet or the Internet, an antenna, etc.

[0113] The embodiments described in this disclosure may involve the use of special purpose or general purpose computers, including various computer hardware or software modules, as discussed in more detail below.

[0114] Embodiments within the scope of the present disclosure also include computer-readable media, or non-transitory computer storage media, for carrying or storing computer-executable instructions or data structures. The instructions, when executed, may cause a processor to perform embodiments of the present invention. Such computer-readable media or computer storage media may be any available medium accessible by a general purpose or special purpose computer. By way of example, and not limitation, such computer-readable media may include RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium accessible by a general purpose or special purpose computer that can be used to carry or store desired program code means in the form of computer-executable instructions or data structures. When information is transferred or provided over a network or another communications connection (either hardwired, wireless, or a combination of hardwired or wireless) to a computer, the computer may regard the connection as a computer-readable medium. In this case, any such connection may be referred to as a computer-readable medium. Combinations of the above should also be included within the scope of computer-readable media.

[0115] Computer-executable instructions include, for example, instructions and data that cause a general purpose computer, special purpose computer, or special purpose processing device to perform a certain function or group of functions. Although the subject matter has been described in language specific to structural features or methodological acts, or both, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as example forms of implementing the claims.

[0116] As used herein, the term "module" or "component" may refer to a software object or routine that executes on a computing system. The various components, modules, engines, and services described herein may be implemented as objects or processes that execute (e.g., as separate threads) on a computing system. Although the systems and methods described herein are preferably implemented in software, implementations in hardware or combinations of software and hardware are also possible and contemplated. As used herein, a "computer" may be any computing system, as previously defined herein, or any module or combination of modules that executes on a computing system.

[0117] With respect to the disclosed processes and / or methods, the functions performed in the processes and methods may be implemented in various orders as the context may suggest. Furthermore, the outlined steps and operations are provided merely as examples, and some of the steps and operations may be optional, combined into fewer steps and operations, or expanded into additional steps and operations.

[0118] The present disclosure is not limited to the specific embodiments described herein, which are intended as examples of various aspects. Many modifications and variations can be made without departing from the scope thereof. From the above description, functionally equivalent methods and devices within the scope of the present disclosure, other than those enumerated, will be apparent to those skilled in the art. Such modifications and variations are intended to fall within the scope of the appended claims. The present disclosure is limited only by the terms of the appended claims, and the full scope of equivalents to which such claims are entitled. It should also be understood that the terminology used in the present disclosure is for the purpose of describing specific embodiments only, and is not intended to be limiting.

[0119] The present disclosure may in some cases illustrate various components that are contained within or connected to various other components. Such architectures depicted are merely exemplary and many other architectures can be implemented which achieve the same or similar functionality.

[0120] The disclosed aspects may be embodied in other forms without departing from the spirit or essential characteristics thereof. The described aspects are to be considered in all respects as illustrative and not restrictive. The claimed subject matter is indicated by the appended claims, rather than by the above description. All changes that come within the meaning and range of equivalency of the claims are to be embraced within their scope.

Claims

1. A method for dynamically determining a trust level of an end-to-end link in a computer database by processing information in the computer database having a memory and a processor, the method comprising: In the preparation stage, capturing a first set of messages for a first end-to-end link; compressing a skeleton of each message in the first set of messages to generate a construct for each message in the first set of messages, the skeleton including the messages that do not include a value field; creating a feature histogram of the constructs of the first set of messages; During the operating stage, capturing a second set of messages for the first end-to-end link; compressing a skeleton of each message in the second set of messages to generate a construct for each of the second set of messages; creating a work histogram of the constructs of the second set of messages; determining a trust level of the first end-to-end link by comparing the work histogram to the feature histogram; A method comprising:

2. 2. The method of claim 1, wherein an end-to-end link is defined according to parameters of the end-to-end link, the parameters being selected from the list consisting of a host name, a service name, a database name, a client host name, an operating system user, and a database user.

3. 2. The method of claim 1, wherein determining the trust level of the end-to-end link comprises determining that the trust level of the end-to-end link is untrusted if at least one of the constructs of the second set of messages is not included in the feature histogram of the constructs of the first set of messages.

4. The method of claim 1 , wherein compressing the skeleton comprises hashing the skeleton.

5. In the preparation stage, adding commands of a first set of the messages divided into command groups to the feature histogram; During said operating stage, adding commands of a second set of the messages divided into command groups to the work histogram; The method of claim 1 , comprising:

6. In the preparation stage, obtaining a plurality of sets of messages, each set associated with an end-to-end link of the set of end-to-end links; generating a construct for each message of said plurality of sets of messages; creating a feature histogram for each end-to-end link of the set of end-to-end links, each feature histogram being created from the construct of a set of messages for an end-to-end link of the set of end-to-end links; clustering the feature histograms to determine clusters of end-to-end links; During operation, comparing the work histogram with each of the feature histograms of the cluster of the first end-to-end link to determine the trust level of the first end-to-end link; The method of claim 1 , comprising:

7. The method of claim 1 , wherein capturing the second set of messages is repeated periodically for each new session.

8. the trust level is selected from trusted and untrusted; if the trust level is trusted, not performing a comprehensive security analysis on subsequent messages of the end-to-end link; applying policy rules to subsequent messages on the end-to-end link if the trust level is not trusted; The method of claim 1 , comprising:

9. The method of claim 1 , further comprising adding the construct for each of the second set of messages to the feature histogram if the trust level is trusted.

10. The method of claim 1 , wherein the work histogram is compared to the feature histogram by comparing the variance of the work histogram to the variance of the feature histogram.

11. A system for executing the method according to any one of claims 1 to 10 by computer hardware having a memory and a processor.

Images