Database Security

Abstract

The method includes the steps of: a database server obtaining a security policy associated with a database hosted by the database server; the database server obtaining first database data associated with the database; the database server creating a knowledge distillation model using the security policy and the first database data; the database server obtaining second database data associated with the database; the database server creating a classification model using the second database data and an output of the knowledge distillation model; the database server receiving a client database request for the database; the database server determining a new security policy rule set using the classification model; and the database server applying the new security policy rule set to the client database request.

Description

[Technical Field]

[0001] Aspects of the present invention relate generally to database security, and more particularly to achieving a balance between database security and database performance using machine learning.

[0002] A database refers to a set of related data organized into a data collection. Databases typically contain schemas, tables, queries, reports, views, and other objects. Databases are used, for example, to support an organization's internal operations and to support online interactions with customers. Databases are also used to hold management information and more specialized data, such as engineering data or economic models.

[0003] Access to the collection of data stored in a database is typically provided by a database management system (DBMS), which consists of computer software that allows users to interact with the database and provides access to the data contained in the database. However, there may be constraints that limit access to certain data. In general, database management systems are designed to allow databases to be defined, created, queried, updated, and managed. Due to the relationship between databases and database management systems, the term database often refers to both the database and its corresponding database management system. Both the database and its corresponding database management system conform to the principles of a particular database model. A database system collectively refers to the database model, the database management system, and the database. A physical database server is a dedicated computer that stores a database and runs the corresponding database management system.

[0004] Finding the optimal balance between database security and database performance has been a long-standing challenge in the field of database security. On the one hand, database customers want to comply with laws, regulations, and audit requirements in order to minimize risks. On the other hand, implementing a database security system is costly in terms of computing resources. Achieving high security in a database usually involves high costs in computing resources. High costs of computing resources usually degrade database performance, thereby posing technical challenges in the field of database security. Summary of the Invention

[0005] In a first aspect of the present invention, there is a computer-implemented method. The method includes a database server obtaining a security policy associated with a database hosted by the database server. The method includes the database server obtaining first database data associated with the database. The method includes the database server creating a knowledge distillation model using the security policy and the first database data. The method includes the database server obtaining second database data associated with the database. The method includes the database server creating a classification model using the second database data and an output of the knowledge distillation model. The method includes the database server receiving a client database request for the database. The method includes the database server determining a new security policy rule set using the classification model. The method includes the database server applying the new security policy rule set to the client database request. Advantageously, such a method is useful for determining a database security rule set that satisfies applicable security policies and rules while minimizing computing resource costs.

[0006] In an embodiment, creating a knowledge distillation model includes determining factors affected by a security policy; and analyzing groupings of the affected factors. In this manner, an embodiment advantageously determines how different group sizes affect security performance.

[0007] In another aspect of the present invention, there is a computer program product comprising one or more computer-readable storage media having program instructions collectively stored on the one or more computer-readable storage media. The program instructions are executable to obtain a security policy associated with a database hosted by a database server. The program instructions are executable to obtain first database data associated with the database. The program instructions are executable to create a knowledge distillation model using the security policy and the first database data. The program instructions are executable to obtain second database data associated with the database. The program instructions are executable to create a classification model using the second database data and an output of the knowledge distillation model. The program instructions are executable to receive a client database request for the database. The program instructions are executable to determine a new security policy rule set using the classification model. The program instructions are executable to apply the new security policy rule set to the client database request. Advantageously, such a computer program product is useful for determining a database security rule set that satisfies applicable security policies and rules while minimizing the cost of computing resources.

[0008] In an embodiment, creating a knowledge distillation model includes determining factors affected by a security policy; and analyzing groupings of the affected factors. In this manner, an embodiment advantageously determines how different group sizes affect security performance.

[0009] In another aspect of the present invention, there is a system comprising a processor, a computer-readable memory, one or more computer-readable storage media, and program instructions collectively stored on the one or more computer-readable storage media. The program instructions are executable to obtain a security policy associated with a database hosted by a database server. The program instructions are executable to obtain first database data associated with the database. The program instructions are executable to create a knowledge distillation model using the security policy and the first database data. The program instructions are executable to obtain second database data associated with the database. The program instructions are executable to create a classification model using the second database data and an output of the knowledge distillation model. The program instructions are executable to receive a client database request for the database. The program instructions are executable to determine a new security policy rule set using the classification model. The program instructions are executable to apply the new security policy rule set to the client database request. Advantageously, such a system is useful for determining a database security rule set that satisfies applicable security policies and rules while minimizing computing resource costs.

[0010] In an embodiment, creating a knowledge distillation model includes determining factors affected by a security policy; and analyzing groupings of the affected factors. In this manner, an embodiment advantageously determines how different group sizes affect security performance. [Brief explanation of the drawings]

[0011] Aspects of the present invention are described in the following detailed description, with reference to the several drawings, which are mentioned by way of non-limiting examples of illustrative embodiments of the invention.

[0012] [Figure 1] 1 illustrates a cloud computing node according to one embodiment of the present invention.

[0013] [Figure 2] 1 illustrates a cloud computing environment according to one embodiment of the present invention.

[0014] [Figure 3] 1 illustrates an abstraction model layer according to one embodiment of the present invention.

[0015] [Figure 4] 1 illustrates a block diagram of an exemplary environment in accordance with an aspect of the present invention.

[0016] [Figure 5] 1 shows a flowchart of an exemplary method according to an aspect of the present invention.

[0017] [Figure 6] 1 illustrates an exemplary parameter set used in creating a knowledge distillation model, according to an aspect of the present invention.

[0018] [Figure 7] 1 illustrates an example set of database statistics, in accordance with an aspect of the present invention.

[0019] [Figure 8] 1 illustrates an example of a database security object definition, in accordance with aspects of the present invention.

[0020] [Figure 9] 1 illustrates an exemplary grouping of influential factors according to an aspect of the present invention.

[0021] [Figure 10] 1 illustrates an exemplary algorithm used in machine learning, according to an aspect of the present invention.

[0022] [Figure 11] 10 shows examples of classification parameters used according to aspects of the present invention.

[0023] [Figure 12] 1 shows a flowchart of an exemplary method according to an aspect of the present invention.

[0024] [Figure 13] 1 shows a flowchart of an exemplary method according to an aspect of the present invention.

[0025] [Figure 14] 14 shows a block diagram of the example use case of FIG. 13 in accordance with an embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0026] A database is an organized collection of data that is stored and accessed by users operating client devices. With the increasing use of cloud computing, more and more databases are located in the cloud. By moving or placing a database in the cloud, access can occur from any location where there is an internet connection.

[0027] Cloud databases are being used to collect, process, and distribute increasingly large amounts of data. The data may contain sensitive information and may also have high compliance requirements. With cloud database services, there is increased access and availability over the Internet. This increased access and availability also increases the exposure of these types of databases to potential unauthorized access. Security policies are currently utilized to protect databases from unauthorized access to the sensitive information therein. These security policies terminate connections when actions are performed that indicate an attempt to access the database unauthorizedly.

[0028] Finding an optimal balance between database security policies and database performance has been a long-standing challenge in the field of database security. Achieving high security in a database typically involves high costs in computing resources. High computing resource costs typically degrade database performance, thereby posing a technical problem in the field of database security. Implementations of the present invention address this technical problem with a technical solution that uses machine learning to determine a database security rule set that satisfies applicable security policies and rules while minimizing computing resource costs. Embodiments utilize a knowledge distillation model to determine the optimal level of security policy and rule enforcement, and further use a classification model to determine the optimal combination of security policies and rules for a particular client database request. In this way, implementations of the present invention utilize machine learning to achieve a balance between database security and database performance.

[0029] The present invention may be a system, method, and / or computer program product at any possible level of technical detail integration. The computer program product may include computer-readable storage medium(s) having computer-readable program instructions for causing a processor to perform aspects of the present invention.

[0030] A computer-readable storage medium may be a tangible device capable of holding and storing instructions for use by an instruction execution device. The computer-readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer-readable storage media includes the following: portable computer diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital versatile disk (DVD), memory sticks, floppy disks, mechanically encoded devices such as punch cards or ridge structures in grooves in which instructions are recorded, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium should not be construed as a transitory signal per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission medium (e.g., light pulses passing through a fiber optic cable), or electrical signals transmitted over electrical wires.

[0031] The computer-readable program instructions described herein may be downloaded from a computer-readable storage medium to each computing / processing device or to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network may comprise copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in a computer-readable storage medium within the respective computing / processing device.

[0032] The computer-readable program instructions for carrying out the operations of the present invention may be either assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, configuration data for an integrated circuit, or source or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk®, C++, etc., and procedural programming languages ​​such as the “C” programming language or similar programming languages. The computer-readable program instructions may run entirely on the user's computer, as a standalone software package, partially on the user's computer, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be to an external computer (e.g., via the Internet using an Internet Service Provider). In some embodiments, electronic circuits including, for example, programmable logic circuits, field programmable gate arrays (FPGAs), or programmable logic arrays (PLAs) can execute computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry to perform aspects of the present invention.

[0033] Aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0034] These computer-readable program instructions may be provided to a processor of a computer or other programmable data processing apparatus to produce a machine, whereby the instructions, executed by the processor of the computer or other programmable data processing apparatus, create means for implementing the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams. These computer-readable program instructions may also be stored on a computer-readable storage medium that can direct a computer, programmable data processing apparatus, and / or other device to function in a particular manner, whereby the computer-readable storage medium on which the instructions are stored comprises an article of manufacture containing instructions for implementing aspects of the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams.

[0035] The computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be executed on the computer, other programmable apparatus, or other device to generate a computer-implemented process, whereby the instructions executing on the computer, other programmable apparatus, or other device implement the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams.

[0036] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of instructions, including one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions noted in the blocks may occur out of the order noted in the figures. For example, two blocks shown in succession may actually be realized as a single step, executed concurrently, substantially concurrently, partially, or fully in an overlapping manner, or the blocks may possibly be executed in reverse order depending on the functionality involved. It should also be noted that each block of the block diagrams and / or flowchart diagrams, and combinations of blocks in the block diagrams and / or flowchart diagrams, may be implemented by a dedicated hardware-based system that performs the specified functions or operations, or executes a combination of dedicated hardware and computer instructions.

[0037] Although this disclosure includes detailed descriptions related to cloud computing, it is understood in advance that implementation of the teachings recited herein is not limited to a cloud computing environment. Rather, embodiments of the present invention can be implemented in conjunction with any other type of computing environment now known or later developed.

[0038] Cloud computing is a service delivery model that enables convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal management effort or interaction with the service provider. This cloud model can include at least five characteristics, at least three service models, and at least four deployment models.

[0039] The characteristics are as follows:

[0040] On-demand self-service: Cloud consumers can unilaterally provision computing capacity, such as server time and network storage, automatically as needed, without requiring human interaction with the provider of the service.

[0041] Wide network access: Capabilities are available over the network and accessed through standard mechanisms that facilitate use by heterogeneous thin or thick client platforms (e.g., cell phones, laptops, and PDAs).

[0042] Resource Pooling: Provider computing resources are pooled to serve multiple consumers using a multi-tenant model, with different physical and virtual resources dynamically allocated and reallocated along with demand. Consumers generally have no control or knowledge over the exact location of the provided resources, although there is a type of location independence in that they may be able to specify location at a higher level of abstraction (e.g., country, state, or data center).

[0043] Rapid scalability: Capacity is provisioned quickly and elastically, sometimes automatically, and can be instantly scaled out or instantly released and instantly scaled in. To the consumer, it often feels like there is unlimited capacity available to provision, and any quantity can be purchased at any time.

[0044] Metered Services: Cloud systems automatically control and optimize resource usage by leveraging metering capabilities at a level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource utilization can be monitored, controlled, and reported, providing transparency to both providers and consumers of the services used.

[0045] The service model is as follows:

[0046] Software as a Service (SaaS): The consumer is offered the ability to use a provider's applications running on a cloud infrastructure. The applications are accessible from a variety of client devices through thin-client interfaces such as web browsers (e.g., web-based email). The consumer does not manage or control the underlying cloud infrastructure, including networks, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings.

[0047] Platform as a Service (PaaS): The ability offered to consumers is to deploy applications they create or acquire, written using programming languages ​​and tools supported by the provider, onto a cloud infrastructure. The consumer does not manage or control the underlying cloud infrastructure, including the network, servers, operating systems, or storage, but does control the deployed applications and, in some cases, the application hosting environment configuration.

[0048] Infrastructure as a Service (IaaS): The ability provided to consumers is to provision processing, storage, network, and other basic computing resources onto which they can deploy and run any software, which may include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure, but does control the operating system, storage, deployed applications, and in some cases, limited control over selected networking components (e.g., host firewalls).

[0049] The deployment model is as follows:

[0050] Private Cloud: Cloud infrastructure is operated exclusively for an organization. It may be managed by the organization or a third party and may exist on-premise or off-premise.

[0051] Community Cloud: Cloud infrastructure is shared by multiple organizations to support a specific community with common interests (e.g., mission, security requirements, policies, and regulatory compliance considerations). It may be managed by the organization or a third party and may exist on-premises or off-premises.

[0052] Public Cloud: Cloud infrastructure is made available to the general public or large industry organizations and is owned by organizations that sell cloud services.

[0053] Hybrid Cloud: A cloud infrastructure that combines two or more clouds (private, community, or public) that remain distinct entities but are bound together by standardized or proprietary technologies that allow for data and application portability (e.g., cloud bursting to load balance between clouds).

[0054] Cloud computing environments are service-oriented with an emphasis on statelessness, low coupling, modularity, and semantic interoperability. At the core of cloud computing is an infrastructure that includes a network of interconnected nodes.

[0055] 1, a schematic diagram of an example cloud computing node is shown. Cloud computing node 10 is merely one example of a suitable cloud computing node and is not intended to suggest any limitation as to the scope of use or functionality of the embodiments of the present invention described herein. In any event, cloud computing node 10 is capable of implementing and / or performing any of the functions described above.

[0056] Cloud computing node 10 includes computer system / server 12, which operates in numerous other general-purpose or special-purpose computing system environments or configurations. Examples of well-known computing systems, environments, and / or configurations that may be suitable for use with computer system / server 12 include, but are not limited to, personal computer systems, server computer systems, thin clients, thick clients, handheld or laptop devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputer systems, mainframe computer systems, and distributed cloud computing environments that include any of the above systems or devices.

[0057] The computer system / server 12 may be described in the general context of computer system-executable instructions, such as program modules, being executed by a computer system. Generally, program modules may include routines, programs, objects, components, logic, data structures, etc. that perform particular tasks or implement particular abstract data types. The computer system / server 12 may be practiced in distributed cloud computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed cloud computing environment, program modules may be located in both local and remote computer system storage media, including memory storage devices.

[0058] 1, computer system / server 12 in cloud computing node 10 is shown in the form of a general-purpose computing device. Components of computer system / server 12 may include, but are not limited to, one or more processors or processing units 16, a system memory 28, and a bus 18 coupling various system components, including system memory 28, to processor 16.

[0059] Bus 18 represents one or more of any of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, and a processor or local bus using any of a variety of bus architectures. By way of example and not limitation, such architectures include an Industry Standard Architecture (ISA) bus, a MicroChannel Architecture (MCA) bus, an Enhanced ISA (EISA) bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus.

[0060] Computer system / server 12 typically includes a variety of computer system-readable media, which can be any available media that can be accessed by computer system / server 12 and includes both volatile and nonvolatile media, removable and non-removable media.

[0061] System memory 28 may include computer system-readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache memory 32. Computer system / server 12 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, a storage system 34 may be provided for reading from and writing to a non-removable, non-volatile magnetic medium (not shown, commonly referred to as a "hard drive"). Although not shown, a magnetic disk drive may be provided for reading from and writing to a removable, non-volatile magnetic disk (e.g., a "floppy disk"), and an optical disk drive may be provided for reading from and writing to a removable, non-volatile optical disk, such as a CD-ROM, DVD-ROM, or other optical media. In such cases, each may be connected to bus 18 by one or more data media interfaces. As further shown and described below, memory 28 may include at least one program product having a set of (e.g., at least one) program module configured to perform the functions of embodiments of the present invention.

[0062] A program / utility 40 having a set (at least one) of program modules 42 may be stored in memory 28, by way of example and not limitation, as well as an operating system, one or more application programs, other program modules, and program data. Each or any combination of the operating system, one or more application programs, other program modules, and program data may comprise an implementation of a networking environment. The program modules 42 generally perform the functions and / or methodologies of embodiments of the present invention described herein.

[0063] The computer system / server 12 may also communicate with one or more external devices 14, such as a keyboard, pointing device, display 24, etc.; one or more devices that allow a user to interact with the computer system / server 12; and / or any device (e.g., a network card, modem, etc.) that allows the computer system / server 12 to communicate with one or more other computing devices. Such communication may occur via an input / output (I / O) interface 22. Furthermore, the computer system / server 12 may communicate with one or more networks, such as a local area network (LAN), a general wide area network (WAN), and / or a public network (e.g., the Internet), via a network adapter 20. As shown, the network adapter 20 communicates with other components of the computer system / server 12 via a bus 18. It should be understood that other hardware and / or software components, not shown, may be used in conjunction with the computer system / server 12. Examples include, but are not limited to, microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data archival storage systems.

[0064] Referring now to FIG. 2, an exemplary cloud computing environment 50 is shown. As shown, the cloud computing environment 50 comprises one or more cloud computing nodes 10 with which local computing devices used by cloud consumers, such as, for example, a personal digital assistant (PDA) or mobile phone 54A, a desktop computer 54B, a laptop computer 54C, and / or an automobile computer system 54N, may communicate. The nodes 10 may communicate with each other. They may be physically or virtually grouped (not shown) in one or more networks, such as a private cloud, a community cloud, a public cloud, or a hybrid cloud, or combinations thereof, as described above. This enables the cloud computing environment 50 to provide infrastructure, platforms, and / or software as a service for which cloud consumers are not required to maintain resources on their local computing devices. It should be understood that the types of computing devices 54A-N shown in FIG. 2 are for illustrative purposes only, and that the computing nodes 10 and the cloud computing environment 50 may communicate with any type of computerized device over any type of network and / or network-addressable connection (e.g., using a web browser).

[0065] Referring now to Figure 3, a set of functional abstraction layers provided by cloud computing environment 50 (Figure 2) is shown. It should be understood in advance that the components, layers, and functions shown in Figure 3 are intended to be exemplary only, and embodiments of the present invention are not limited thereto. As shown, the following layers and corresponding functions are provided:

[0066] Hardware and software layer 60 comprises hardware and software components. Examples of hardware components include mainframe 61; RISC (reduced instruction set computer) architecture-based servers 62; servers 63; blade servers 64; storage devices 65; and network and networking components 66. In some embodiments, software components comprise network application server software 67 and database software 68.

[0067] The virtualization layer 70 provides an abstraction layer over which the following examples of virtual entities can be provided: virtual servers 71; virtual storage 72; virtual networks, including virtual private networks 73; virtual applications and operating systems 74; and virtual clients 75.

[0068] In one example, management layer 80 may provide the functions described below. Resource provisioning 81 provides dynamic procurement of computing and other resources utilized to execute tasks within the cloud computing environment. Metering and pricing 82 provides cost tracking as resources are utilized within the cloud computing environment and accounting or billing for the consumption of these resources. In one example, these resources may include application software licenses. Security provides identity verification for cloud consumers and tasks, as well as protection for data and other resources. User portal 83 provides consumers and system administrators with access to the cloud computing environment. Service level management 84 provides cloud computing resource allocation and management so that required service levels are met. Service level agreement (SLA) planning and fulfillment 85 provides advance arrangements and procurement of cloud computing resources where future requirements are anticipated according to SLAs.

[0069] The workload tier 90 provides examples of functions for which a cloud computing environment can be utilized. Examples of workloads and functions that can be provided from this tier include mapping and navigation 91; software development and lifecycle management 92; virtual classroom instruction delivery 93; data analytics processing 94; transaction processing 95; and database security policy determination 96.

[0070] 1, in which one or more of the program modules 42 are configured to perform (or cause the computer system / server 12 to perform) one or more functions of the database security policy determination 96 of FIG. 3. For example, one or more of the program modules 42 may be configured to: obtain a security policy associated with a database hosted by the database server; obtain first database data associated with the database; create a knowledge distillation model using the security policy and the first database data; obtain second database data associated with the database; create a classification model using the second database data and an output of the knowledge distillation model; receive a client database request for the database; determine a new security policy rule set using the classification model; and apply the new security policy rule set to the client database request. Such utilization of machine learning to determine database security rule sets that satisfy applicable security policies and rules while minimizing the cost of computing resources provides an improvement in the art.

[0071] FIG. 4 shows a block diagram of an exemplary environment according to an aspect of the present invention. In an embodiment, the environment includes a client device 400 and a security server 405 connected via a network 410. The client device 400 comprises a computing device including one or more elements of computer system / server 12 and may include, for example, a desktop computer, a laptop computer, a tablet computer, or a smartphone. In one example, a database client utilizes the client device 400 to access a database managed by a database server 415. The network 410 includes one or more communication networks, such as one or more of a LAN, a WAN, and the Internet. The security server 405 and the database server 415 each comprise one or more servers including one or more elements of computer system / server 12. In a cloud implementation, the network 410 comprises the cloud computing environment 50 of FIG. 2, the client device 400 comprises one of the computing devices 54A-N shown in FIG. 2, and the security server 405 and the database server 415 each comprise one or more cloud computing nodes 10 of FIG. 2.

[0072] In an embodiment, database server 415 includes security module 420, which may include one or more program modules, such as program module 42 described with respect to FIG. 1 . Database server 415 may include additional or fewer modules than those shown in FIG. 4 . For example, database server 415 may include additional modules programmed to function as one or both of a database application and a database management system, as those terms are understood by those skilled in the art. In an embodiment, separate modules may be integrated into a single module. Additionally, or alternatively, a single module may be implemented as multiple modules. Furthermore, the number of devices and / or networks in an environment is not limited to those shown in FIG. 4 . Indeed, an environment may include additional devices and / or networks; fewer devices and / or networks; different devices and / or networks; or differently arranged devices and / or networks than those shown in FIG. 4 .

[0073] According to an aspect of the present invention, security module 420 is programmed to create knowledge distillation model 445 using database statistics 425, operating system statistics 430, and database security object definitions 435. In an embodiment, security module 420 obtains database security policies and rules from multiple legacy database security systems. The policies and rules include numerous parameters that can be used in larger machine learning models to construct a suite of new security policies. In an embodiment, for a particular set of database statistics 425, operating system statistics 430, and database security object definitions 435, security module 420 creates a smaller machine learning model (knowledge distillation model 445) that uses machine learning algorithms and knowledge distillation techniques to determine a definition of relevant database security requirements generated from a limited number of initial inputs. In this manner, security module 420 is configured to determine new multi-level security policy rules for the database, where multi-level means that there are different sets of policies and rules for different levels of the database (e.g., the database application level, the runtime level, the storage level, etc.).

[0074] According to an aspect of the present invention, security module 420 is programmed to utilize the output of knowledge distillation model 445, operating system statistics 430, and business requirements 440 to create classification model 450. In an embodiment, security module 420 uses a machine learning algorithm to train a machine learning model (classification model 450) using the output of knowledge distillation model 445, operating system statistics 430, and business requirements 440. Trained classification model 450 receives as input a particular set of operating system statistics 430 and business requirements 440 and outputs a new set of policy rules. In this manner, security module 420 determines a new set of policy rules to apply to database requests made by client device 400.

[0075] 5 shows a flowchart of an exemplary method according to an embodiment of the present invention. The method steps may be performed in the environment of FIG. 4 and will be described with reference to elements shown in FIG.

[0076] In step 501, the system retrieves database security policies and rules from a conventional database security system. In an embodiment, the security module 420 retrieves database security policies and rules from systems such as collectors and database servers. Non-limiting examples of policies include: sending a warning message (e.g., email) to a data security administrator in response to a particular IP address or application sending a query to a database server; sending a warning message (e.g., email) to a data security administrator in response to a managed user querying a database in a predetermined time window; sending only a predetermined number of rows (e.g., 100 rows) in the results when a managed user attempts to query a particular table column in a database; and terminating a database connection if a user attempts to query a managed table more than a specified number of times. Rules may include exception rules and access rules, for example, some non-limiting examples of which are exception rule (login failure - log violation); exception rule (login failure - warn if repeated); exception rule (SQL error - log); exception rule (SQL error - warn about errors that represent a risk); access rule (select command - log full details); access rule (DDL command - log full details); access rule (suspicious user - log full details); and access rule (administrative user - log full details).

[0077] In step 502, the system obtains database data including database statistics, operating system statistics, and database security object definitions for the database. In an embodiment, security module 420 determines database statistics 425, operating system statistics 430, and database security object definitions 435 from data available via database server 415. In one example, security module 420 obtains this data from a database management system running on this database server 415. Database statistics 425 are further described in FIG. 7. Database security object definitions 435 are further described in FIG. 8. In one example, the operating system statistics used in this step include one or more of CPU speed; CPU time; I / O rate; page reads / writes; and network packages sent / received.

[0078] In step 503, the system creates a knowledge distillation model using the policies and rules from step 501 and the database data from step 502. The knowledge distillation model 445 and its creation by the security module 420 are further described in Figures 9 and 10.

[0079] In step 504, the system retrieves database data including operating system statistics 430 and business requirements 440. In an embodiment, security module 420 determines operating system statistics 430 and business requirements 440 from data available via database server 415. In one example, security module 420 retrieves this data from a database management system running on this database server 415. In one example, the operating system statistics 430 used in this step include one or more of: CPU utilization; I / O utilization; received network packages; query queue; and page waits. In one example, the business requirements 440 used in this step include one or more of: system performance impact must not exceed a predetermined amount; and I / O wait must not exceed a predetermined amount.

[0080] In step 505, the system uses the output of the knowledge distillation model (from step 503) to create a new classification model that includes operating system statistics 430 and business requirements 440 (from step 504). In an embodiment, security module 420 uses a machine learning algorithm to train classification model 450 using the output of knowledge distillation model 445, operating system statistics 430, and business requirements 440. In an embodiment, trained classification model 450 is configured to receive as input a particular set of operating system statistics 430 and business requirements 440, and output a new set of policy rules for this database for the particular set of operating system statistics 430 and business requirements 440.

[0081] The system receives a client database request at step 506. In an embodiment, the database server 415 receives the database request from the client device 400, for example, via a database application or database management system.

[0082] In step 507, the system determines operating system statistics 430 and business requirements 440 associated with the request (from step 506). In an embodiment, the business requirements 440 are defined via user input. In an embodiment, the operating system statistics 430 are obtained using a software collection tool, such as a general system statistics collection tool or a server-side database security tool.

[0083] In step 508, the system determines a new policy rule set for the client database request by inputting the operating system statistics 430 and business requirements 440 of the client database request into classification model 450. In an embodiment, security module 420 inputs operating system statistics 430 and business requirements 440 (from step 507) into classification model 450 (from step 505). The output of classification model 450 is a policy rule set for the client database request (from step 506). An example of a new policy rule set is shown in FIG. 11.

[0084] The system applies the new policy rule set to this client database request in step 509. In an embodiment, a software security tool running on the system (e.g., on security server 405) applies the determined policy rule set (from step 508) to this client database request (from step 506), for example, via a database application or database management system.

[0085] FIG. 6 illustrates an exemplary parameter set 600 used in creating a knowledge distillation model 445 according to an aspect of the present invention. In an embodiment, the parameter set 600 includes factors (e.g., impacted factors) included in the database security policies and rules obtained in step 501 of FIG. 5. In an embodiment, the security module 420 determines the parameter set 600 by analyzing the database security policies and rules obtained in step 501 of FIG. 5. In one example, the security module 420 identifies all factors included in the database security policies and rules and then uses cosine similarity to determine which factors should be considered impacted factors for inclusion in the parameter set 600. In this example, the security module 420 creates vectors corresponding to the database security policies and rules. The security module 420 uses cosine similarity to compare similarities between different vectors. In an embodiment, the security module 420 vectorizes the nodes to calculate all factors and also utilizes a dynamic threshold. In this manner, security module 420 determines which factors to include in the parameter set based on comparing the determined cosine similarity to a threshold, and factors having a similarity above the threshold are included in parameter set 600. The factors shown in parameter set 600 of Figure 6 are examples, and other databases may have different factors in their parameter sets.

[0086] 7 illustrates an example set 700 of database statistics obtained in step 502 of FIG. 5 according to an embodiment of the present invention. The database statistics illustrated in set 700 are exemplary, and other databases may have different statistics. In this example, set 700 includes database objects including tables, single-column, multi-column, and partitioned tables. In this example, set 700 includes statistics (e.g., cardinality, etc.) for each of the database objects. In an embodiment, the database server obtains the database statistics using database internal functions or external system tools.

[0087] FIG. 8 shows an example of a database security object definition obtained in step 502 of FIG. 5 according to an embodiment of the present invention. The database security object definition shown in FIG. 8 is an example; other databases may have different database security object definitions. In this example, SDBDPTR 800 is a pointer to a parent node that manages the database on behalf of a database management system. In this example, SOBDDBD (security object definition, database description) 805 is a security object definition that defines a database as a collection of database objects. In this example, SOBDPSET (security object definition, page set) 810 is a security object definition that defines a database page set, which is an instance of a database file. In this example, SOBDFS (security object definition, file system) 815 is a security object definition that defines an access path to data as an index, hash, or link. In this example, SOBDFILE (security object definition, file) 820 is a security object definition that defines a tablespace as a collection of tables and / or page sets. In this example, SOBDREC (security object definition, record) 825 is a security object definition that defines a table and defines rows within the table. In embodiments, security object definitions 810, 815, 820, 825 define different levels of security policies and rules to apply to a database associated with database server 415 (of FIG. 4). In this manner, the system determines two groups of data that are included in the database security policies and rules and that are incorporated into different database security object levels. In some embodiments, the database server adds parameters to the database objects, and the database is configured to implement these parameters.

[0088] FIG. 9 illustrates an exemplary grouping of affected factors according to an aspect of the present invention. In an embodiment, in step 503 of FIG. 5, security module 420 categorizes affected parameters (from parameter set 600 of FIG. 6, shown as points in the graph of FIG. 9) into different groups 901a-c and 902a-c. Security module 420 then analyzes the grouping of affected parameters to determine how different group sizes affect security performance (i.e., security rule and policy satisfaction). Based on this analysis and using database data (e.g., database statistics, operating system statistics, and database security object definitions obtained in step 502 of FIG. 5), security module 420 creates a machine learning model (e.g., knowledge distillation model 445 of FIG. 4) that receives first groups (e.g., 901a-c) having relatively small group sizes and outputs second groups (e.g., 902a-c) having relatively large group sizes. In embodiments, a model is created and trained using the machine learning algorithms and training data described herein, such that, given a set of input group sizes, the model is configured to determine at least one new group size that satisfies security requirements and also optimizes computing performance. In embodiments, the system utilizes a cost function based on operating system statistics to model and thereby optimize computing performance. In one example, the model is created and trained to determine an optimal maximum group size that satisfies security requirements. In this manner, the model receives as input a first set of groups having a relatively small group size and produces as output a second set of groups having a relatively large group size, where the second set of groups meets the same security requirements as the first set of groups but with higher (e.g., lower cost) computing performance than the first set of groups.In embodiments, group sizes correspond to policies and rules for different levels of the database (e.g., the database application level, the runtime level, and the storage level). In this manner, by using the model to determine different group sizes, the model can be used to determine the application of rules at different levels to satisfy the same security policy at a lower computing cost, which provides an improvement in the art.

[0089] Still referring to FIG. 9 , in an embodiment, determining group size includes preparing policy rules and calculating a vector relationship map. In some examples, each policy rule is flexible to search for related policy rules. Thus, after the above-described factor data vectorization, vector distance can be calculated using the vector's included angle. In an embodiment, step 503 of FIG. 5 also includes a policy rule that adds "execute action" as a specific group for level definition to ensure both group size and effect are as expected. In an embodiment, step 503 of FIG. 5 also includes screening and pruning specific groups for policy level definition. In an implementation, these steps are used to create a model that receives small-sized groups as input and produces groups as output with different sizes and different levels of computational cost for execution compared to the computational cost of smaller-sized groups. In one exemplary implementation, the security module 420 creates the model using a feed-forward network (FFN) and trains the neural network according to algorithms 1001 and 1002 shown in FIG. 10 .

[0090] FIG. 11 shows example classification parameters used in accordance with an embodiment of the present invention. FIG. 11 shows a first table 1100 of classification parameters, including table cardinality, page number, access frequency, index level, and policy set. FIG. 11 also shows a second table 1105 of classification parameters, including policy type, session queue, action level, query queue, and statement complexity. The classification parameters shown in FIG. 11 are examples, and other databases may have different classification parameters. In an embodiment, the classification parameters shown in FIG. 11 are used to create and train a classification model in step 505 of FIG. 5. For example, the classification parameters may include some or all of the operating system statistics and business requirements used to train the classification model. In one example, the classification model is trained using a logistic regression technique.

[0091] Figure 12 shows a flowchart of an exemplary method according to an aspect of the present invention. The steps of the method may be performed in the environment of Figure 4 and are described with reference to elements shown in Figure 4. The method of Figure 12 is an example of a use case involving a partition operation. In an embodiment, the database server 415 identifies potential objects in step 1201 (e.g., by using security policies or rules to determine the objects (tables, columns, or partitions) involved in the security check), opens partitioned page sets in step 1202, opens page set pieces in step 1203 (e.g., using database operation tasks to open the partitioned page sets and page set pieces of the associated objects), and checks whether to bypass or block the objects in step 1204 (e.g., based on comparing policies with the determined objects). Based on the check in step 1204, the database server 415 performs one of the following actions: block the partition in step 1205 (e.g., block the query from the schema level for advanced violations), bypass the security rule in step 1206 (e.g., if there is no violation), or block the results from the SOBD in step 1207 (e.g., block the query only for a specific partition).

[0092] FIG. 13 shows a flowchart of an exemplary method according to an aspect of the present invention. The steps of the method may be performed in the environment of FIG. 4 and are described with reference to elements shown in FIG. 4. The method of FIG. 13 is an example of a use case involving a result set restriction operation. In an embodiment, database server 415 identifies potential objects in step 1301 (e.g., by using security policies or rules to determine objects (tables, columns, or partitions) involved in the security check) and checks whether to bypass or block the objects in step 1302 (e.g., based on comparing the policies with the determined objects). Based on the check in step 1302, database server 415 performs one of the following actions: blocks the result set in step 1303 (e.g., by terminating the connection from the database server), bypasses the security rules in step 1304 (e.g., obtains the full result set from the database server), or applies an enhanced security policy in steps 1305-1308. In an embodiment, the database server 415 recalculates the access path change in step 1305 (e.g., by calculating a cost based on a specific security object and then selecting a new access path), obtains the returned results from each SOBD in step 1306 (e.g., obtains the results returned from each SOBD along with the new access path), consolidates the SOBD results in step 1307 (e.g., consolidates the results from step 1306), and provides the final result in step 1308 (e.g., returns the result to the user).

[0093] Figure 14 shows a block diagram 1400 of the example use case of Figure 13, in accordance with an embodiment of the present invention. In block diagram 1440, the solid lines correspond to the database operations performed in step 1304 of Figure 13, which generate a relatively large result set (e.g., 250,000 * 4000 = 1,000,000,000), which are then reduced to a final result size (e.g., 100), which utilizes a relatively large amount of computing resources. In block diagram 1440, the dashed lines correspond to the database operations performed in steps 1305-1308 of Figure 13, which result in a relatively small result set (e.g., 100), which utilizes a relatively small amount of computing resources.

[0094] Embodiments may be implemented using a cloud-based federated model. In these embodiments, for different database nodes, the system trains a federated model to learn distilled models from other database nodes with similar business requirements, database traffic, or security requirements. In these embodiments, the method includes: determining aligned samples and features; computing intermediate gradient results on different database nodes using iterations; computing until convergence of the loss is achieved; and each node refreshing the model parameters.

[0095] In embodiments, a service provider may offer to perform the processes described herein. In this case, the service provider may create, maintain, deploy, support, etc., a computer infrastructure that performs the process steps of the present invention for one or more customers. These customers may be, for example, any technology-using business. In return, the service provider may receive compensation from the customer based on a subscription and / or fee agreement, and / or the service provider may receive compensation from the sale of advertising content to one or more third parties.

[0096] In yet an additional embodiment, the present invention provides a computer-implemented method over a network. In this case, a computer infrastructure, such as computer system / server 12 (FIG. 1), may be provided, and one or more systems for performing the processes of the present invention may be acquired (e.g., created, purchased, used, modified, etc.) and deployed to the computer infrastructure. To this extent, deploying the systems may comprise one or more of: (1) installing program code from a computer-readable medium on a computing device, such as computer system / server 12 (as shown in FIG. 1); (2) adding one or more computing devices to the computer infrastructure; and (3) incorporating and / or modifying one or more existing systems of the computer infrastructure to enable the computer infrastructure to perform the processes of the present invention.

[0097] The description of various embodiments of the present invention has been presented for illustrative purposes, but is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope of the described embodiments. The terminology used herein has been selected to best explain the principles of the embodiments, practical applications of, or technical improvements to, the technology found in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. a database server obtaining a security policy associated with a database hosted by said database server; the database server obtaining first database data associated with the database; the database server creating a knowledge distillation model using the security policy and the first database data; the database server obtaining second database data associated with the database; the database server creating a classification model using the second database data and the output of the knowledge distillation model; receiving, by the database server, a client database request for the database; the database server using the classification model to determine a new security policy rule set; and the database server applying the new security policy rule set to the client database request. A method comprising:

2. The step of creating the knowledge distillation model comprises: determining factors affected by the security policy; and Analyzing the grouping of the influencing factors 2. The method of claim 1, comprising:

3. The method of claim 1 or 2, wherein the first database data comprises database statistics, operating system statistics, and database security object definitions.

4. 4. The method of claim 3, wherein the database security object definitions include a plurality of different database security object definitions at a plurality of different levels of the database.

5. The method of claim 1 , wherein the second database data comprises operating system statistics and business requirements data.

6. The classification model: receiving as input parameters associated with the client database request; and generating as output the new security policy rule set based on the input; 6. The method according to any one of claims 1 to 5.

7. the database is one of a plurality of different database nodes; and creating the knowledge distillation model comprises training a federated model using data from the plurality of different database nodes; 7. The method according to any one of claims 1 to 6.

8. 1. A computer program product having program instructions that cause a processor to: obtaining a security policy associated with a database hosted by the database server; obtaining first database data associated with the database; creating a knowledge distillation model using the security policy and the first database data; obtaining second database data associated with the database; creating a classification model using the second database data and the output of the knowledge distillation model; receiving a client database request for said database; determining a new security policy rule set using the classification model; and applying the new security policy rule set to the client database request; A computer program that executes

9. The procedure for creating the knowledge distillation model is: determining factors affected by the security policy; and A procedure for analyzing the grouping of the aforementioned influential factors 9. The computer program of claim 8, comprising:

10. 10. The computer program product of claim 8 or 9, wherein the first database data comprises database statistics, operating system statistics, and database security object definitions.

11. 11. The computer program product of claim 10, wherein the database security object definitions include a plurality of different database security object definitions at a plurality of different levels of the database.

12. 12. The computer program product of claim 8, wherein the second database data comprises operating system statistics and business requirements data.

13. The classification model: receiving as input parameters associated with the client database request; and generating as output the new security policy rule set based on the input; A computer program according to any one of claims 8 to 12.

14. the database is one of a plurality of different database nodes; and and creating the knowledge distillation model comprises training a federated model using data from the plurality of different database nodes. A computer program according to any one of claims 8 to 13.

15. a processor, a computer-readable memory, one or more computer-readable storage media, and program instructions collectively stored on the one or more computer-readable storage media. wherein the program instructions cause the processor to: obtaining a security policy associated with a database hosted by the database server; obtaining first database data associated with the database; creating a knowledge distillation model using the security policy and the first database data; obtaining second database data associated with the database; creating a classification model using the second database data and the output of the knowledge distillation model; receiving a client database request for said database; determining a new security policy rule set using the classification model; and applying the new security policy rule set to the client database request; A system that executes the following.

16. The procedure for creating the knowledge distillation model is: determining factors affected by the security policy; and A procedure for analyzing the grouping of the aforementioned influential factors The system of claim 15, comprising:

17. The first database data comprises database statistics, operating system statistics, and database security object definitions; and the database security object definitions include a plurality of different database security object definitions at a plurality of different levels of the database; 17. A system according to claim 15 or 16.

18. 18. The system of claim 15, wherein the second database data comprises operating system statistics and business requirements data.

19. The classification model: receiving as input parameters associated with the client database request; and generating as output the new security policy rule set based on the input; 19. A system according to any one of claims 15 to 18.

20. the database is one of a plurality of different database nodes; and and creating the knowledge distillation model comprises training a federated model using data from the plurality of different database nodes.

20. A system according to any one of claims 15 to 19.

Images