Database Intrusion Sensor for Internal Threat Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network perimeter defense systems are ineffective in defending databases against internal threats, such as employees with valid accounts, Trojan horses, and accidental data manipulation, in addition to external attacks.
Innovation Solution
An intrusion detection sensor is implemented to directly access the database, scanning transactions and generating events based on a detection profile, achieving high intrusion detection efficiency and success rates with low processor utilization, even at high transaction rates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network perimeter defense systems are implemented to block malicious traffic, then external attacks are prevented, but internal threats such as employees with valid accounts, Trojan horses, and accidental data manipulation cannot be detected
Solution Approach 1:
The system segments security monitoring into two distinct components: network perimeter defense for external threats and database intrusion sensor for internal threats. The sensor is installed directly on the database server and monitors database transactions separately from network traffic, enabling detection of internal threats that bypass perimeter defenses.
Solution Approach 2:
The database intrusion sensor acts as an intermediary component installed on the database server that intercepts and analyzes database transactions. It receives copies of transaction data from the database and compares them against detection profiles to identify suspicious patterns, serving as a bridge between database operations and security analysis.
2Measurement precision
If an intrusion detection sensor directly accesses the database to scan transactions, then detection success rate increases, but processor utilization increases
Solution Approach 1:
The sensor implements partial action by monitoring only specific database transactions that match detection profile criteria rather than analyzing every transaction in detail. It uses selective event generation where events are created only when suspicious patterns are detected, reducing overall processing load while maintaining high detection rates for actual threats.
Solution Approach 2:
The system changes operational parameters dynamically by adjusting detection sensitivity and event generation thresholds based on system conditions. The sensor can modify its monitoring intensity and resource consumption characteristics to balance detection effectiveness with processor utilization requirements.
Data Source
AI summary
Some demonstrative embodiments of the invention relate to a method, device and system of database security. One demonstrative embodiment of the invention includes an intrusion detection sensor to scan transactions on a database, and generate an event based on a detection profile. Other embodiments are described and claimed.