Database Protocol Metadata Anomaly Detection via Bayesian ML
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing database protection systems struggle to detect all forms of anomalous database connections, particularly low-probability events and activities outside expected access violations, allowing malicious clients to access servers undetected.
Innovation Solution
A machine learning-based approach is implemented within the database protection system to detect anomalies by training a model on database protocol metadata, identifying dominant patterns, and using these patterns to flag unusual connections, thereby supplementing or replacing conventional rule-based security methods.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If rule-based security validation is used to detect database access violations, then known security threats can be identified, but low-probability anomalies and unknown attack patterns cannot be detected
Solution Approach 1:
The patent changes the detection parameters from discrete security rules to continuous probability distributions of database protocol metadata. By modeling the joint distribution of multiple metadata parameters (protocol type, driver version, connection settings) and comparing actual connections against this model, the system can detect anomalies that deviate from normal patterns, thereby improving both reliability and adaptability in detecting diverse attack patterns.
2Measurement precision
If discrete security rules are configured to validate database transactions, then specific access violations can be detected, but the system cannot recognize anomalies outside the predefined rule set
Solution Approach 1:
The patent replaces the mechanical rule-based validation system with a statistical learning system. Instead of using predefined security rules that require manual configuration and updating, the system learns the normal distribution patterns of database protocol metadata from training data and automatically detects deviations, making the system more capable of detecting unusual connections without requiring explicit rules for each threat.
3Productivity
If conventional database protection systems monitor protocol packets, then transaction validation can be performed, but runtime detection of subtle metadata anomalies is not achieved
Solution Approach 1:
The patent performs preliminary action by training the anomaly detection model offline using historical database protocol metadata before deployment. This pre-training phase allows the system to learn the joint distribution patterns of normal connections in advance, so that during runtime, the system can quickly compare incoming connections against the established model without requiring complex real-time analysis, thus maintaining high productivity while improving detection reliability.
Data Source
AI summary
A database protection system (DPS) detects anomalies in real time without reliance on discrete security rules, instead relying on a machine learning-based approach. In particular, a Bayesian machine learning model is trained on a set of database protocol metadata (DPM) that the system collects during its runtime operation. Typically, a set of DPM parameters is protocol-specific. The approach herein presumes that DPM parameters are not independent, and that their conditional dependencies (as observed from the database connections) can be leveraged for anomaly detection. To that end, the machine learning model is trained to detect dominant (repeating) patterns of connection DPM parameters. Once trained, the model is then instantiated in the DPS and used to facilitate anomaly detection by identifying connections that do not conform to these patterns, i.e. that represent unusual connection DPM parameters.