Anomaly Detection in Database Audit Logs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing complexity of audit logs makes it difficult to detect anomalies indicative of suspicious or malicious behavior, as existing database activity monitoring techniques struggle to analyze and identify anomalies effectively.
Innovation Solution
An anomaly detection framework that generates profiles for attribute values in audit logs, allowing for the identification of expected characteristics of other attributes, enabling the detection of deviations and thus anomalies, from specific perspectives such as application user or function behavior.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If database activity monitoring techniques generate detailed audit logs of database operations, then the ability to monitor and analyze database activity improves, but the complexity of analyzing and detecting anomalies in the audit logs increases
Solution Approach 1:
The patent segments the audit log analysis by creating separate profiles for different attribute values (e.g., user profiles, function profiles, database object profiles). Each profile captures expected characteristics for a specific attribute value, allowing the system to analyze logs from multiple granular perspectives rather than as a monolithic complex structure.
Solution Approach 2:
The patent performs preliminary action by generating profiles from audit logs before anomaly detection occurs. These profiles establish baseline expected characteristics of attribute values and their relationships, so that when new log entries are analyzed, comparisons can be made against pre-established expectations rather than requiring complex real-time analysis.
2Productivity
If existing database activity monitoring techniques analyze audit logs, then some anomaly detection capability is provided, but the techniques struggle to effectively identify anomalies due to log complexity
Solution Approach 1:
The patent introduces another dimension to anomaly detection by analyzing logs from multiple attribute perspectives simultaneously (user dimension, function dimension, database object dimension). Instead of single-dimensional analysis, the system creates profiles for each attribute value and detects anomalies by comparing against multiple dimensional expectations, making detection more effective despite complexity.
Solution Approach 2:
The patent applies parameter changes by dynamically adjusting detection parameters based on the specific attribute being analyzed. Different attribute values have different expected characteristics stored in their profiles, allowing the system to adapt detection thresholds and criteria to match the specific context of each log entry rather than using fixed parameters.
Data Source
AI summary
A method by one or more computing devices for detecting application user anomalies in audit logs of database operations performed on one or more databases. The method includes obtaining a first audit log of database operations, wherein the first audit log indicates (1) which application users of an application caused which of the database operations to be performed and (2) which functions of the application caused which of the database operations to be performed, generating, for each of the application users indicated in the first audit log, a profile of that application user that indicates which of the functions that application user is expected to touch, and detecting an anomaly in response to a determination that a second audit log indicates that an application user touched a function that is not one of the functions indicated in the profile of the application user.