Attribute-Based Anomaly Detection in Relational Database Queries
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Relational database security is compromised due to the inability of existing systems to effectively detect and respond to anomalous SQL queries that deviate from common or legitimate access patterns, posing a risk to sensitive information.
Innovation Solution
A system that performs attribute-based anomaly detection in relational database queries by comparing given queries to a set of non-anomalous queries, using semantic attributes and additional attributes to calculate similarities and determine if the query meets a similarity threshold, thereby identifying and flagging anomalous queries.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing SQL query systems are used without anomaly detection, then ease of operation is maintained, but security reliability deteriorates due to inability to detect anomalous queries
Solution Approach 1:
The patent introduces an intermediary anomaly detection system that sits between the SQL query interface and the database. This intermediary component analyzes queries using semantic attributes and similarity calculations without requiring changes to the core database system, thereby improving security while maintaining operational simplicity.
Solution Approach 2:
The patent replaces traditional mechanical security approaches (such as access control lists and permission-based security) with a semantic-based detection system that uses natural language processing and similarity algorithms to identify anomalous queries, providing more sophisticated security without increasing operational complexity.
2Measurement precision
If semantic attribute-based anomaly detection is implemented, then measurement precision of query analysis is improved, but device complexity increases due to additional processing requirements
Solution Approach 1:
The patent segments the query analysis process into distinct components: extracting semantic attributes from queries, calculating similarities between query attributes, and comparing against thresholds. This segmentation allows each component to be optimized independently and simplifies the overall system architecture.
Solution Approach 2:
The patent transforms SQL queries into semantic attribute representations (changing parameters from syntactic to semantic), enabling more precise anomaly detection. By changing the parameter space from raw SQL syntax to semantic concepts, the system achieves higher measurement precision while managing complexity through parameter transformation.
3Reliability
If comprehensive semantic attribute analysis is performed on all queries, then anomaly detection capability is improved, but processing time increases
Solution Approach 1:
The patent applies partial action by performing semantic attribute analysis selectively rather than on every query. The system calculates similarities only for queries that warrant deeper analysis based on initial filtering, reducing overall processing time while maintaining high anomaly detection capability for suspicious queries.
Solution Approach 2:
The patent implements a multi-stage filtering approach where obviously normal queries are quickly identified and skipped through comprehensive analysis. The system rushes through simple similarity comparisons for common query patterns while reserving detailed semantic analysis for queries that show potential anomaly indicators, thereby reducing average processing time.
Data Source
AI summary
Techniques for detecting an anomaly in queries of a relational database are disclosed. The techniques include obtaining a set of semantic attributes for a query of a relational database. The semantic attributes are then used to calculate a set of similarities between the query and a set of non-anomalous queries of the relational database. When a highest similarity in the set of similarities does not meet a similarity threshold, an indication that the query is anomalous is outputted.