Database User Classification via Activity Time Series
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data protection and monitoring systems face difficulties in differentiating between types of database users, such as direct users, application users, and machine users, which hinders the application of appropriate security policies and event significance levels.
Innovation Solution
A system and method that classify database users based on activity rate time series features, including repetition measures, using Fourier transforms and machine learning models to determine user types, enabling tailored security policies and significance levels.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data protection systems use policy rules to track and monitor data accesses, then security monitoring capability is improved, but the ability to differentiate between user types (direct, application, machine) deteriorates
Solution Approach 1:
The system transitions from monitoring only policy rule compliance to analyzing temporal activity patterns by extracting features from activity rate time series. By introducing temporal parameters (activity rate over time, repetition measures, Fourier transforms) alongside traditional policy parameters, the system achieves both security monitoring and precise user type differentiation simultaneously
Solution Approach 2:
The system replaces simple policy rule matching with machine learning classification models that process temporal activity patterns. Using ML models trained on activity rate time series features enables more accurate user type identification while maintaining security monitoring functions
2Measurement precision
If user classification is based on traditional policy rules, then system complexity is low, but user type differentiation accuracy is insufficient
Solution Approach 1:
The system segments the activity rate time series into multiple features including repetition measures, mean activity load, and percentage active time. By dividing the complex activity pattern into distinct measurable components, the system achieves accurate user type differentiation while maintaining manageable processing complexity through structured feature extraction
Solution Approach 2:
The system introduces activity rate time series analysis as an intermediary layer between raw database access logs and user type classification. This intermediary processing step transforms raw access data into meaningful temporal patterns that feed into ML classification models, improving accuracy without directly increasing system complexity
3Reliability
If security policies are applied uniformly to all users, then policy implementation is simple, but security effectiveness deteriorates
Solution Approach 1:
The system applies different security policies and significance levels tailored to each user type (direct, application, machine). By customizing security parameters according to the specific characteristics and risk profiles of different user types, the system enhances security effectiveness while managing complexity through automated classification
Solution Approach 2:
The system dynamically adjusts security policy application based on real-time activity pattern analysis. Rather than static uniform policies, the system continuously monitors activity rate time series and adapts security responses according to detected user types and their behavioral patterns, improving effectiveness through dynamic response
Data Source
AI summary
A computer-based system and method for classifying users of a database including obtaining an activity rate time series describing activity level of a database user versus time, extracting features from the activity rate time series, the features including a measure of repetition in the activity level, mean activity load and a percentage of the time in which the user is active, and determining a type of the database user based on the extracted at least one feature. The measure of repetition in the user activity is calculated by performing a Fourier transform on the activity rate time series to produce a transformed series; detecting spikes in the transformed series; and measuring a percentage of information in the transformed series which is included in the spikes.