Decoy Database Object Access Detection via Connection Type Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current database security systems generate excessive false positives when detecting malicious attempts to access decoy database objects, leading to alerts being ignored and potentially compromising database security.
Innovation Solution
Implementing a system that determines the connection type between database clients and the server, generating alerts only for access attempts deemed malicious based on pre-configured rules, such as application or user-generated queries, thereby reducing false positives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If alerts are generated for all accesses to decoy database objects, then security monitoring coverage is improved, but false positive rate increases
Solution Approach 1:
The patent applies local quality by differentiating between application-generated queries and user-generated queries. Application connections are monitored with stricter rules (alerting on any decoy access), while user connections use more permissive rules (allowing certain query patterns). This localized differentiation improves detection accuracy while reducing false positives from legitimate user activities.
Solution Approach 2:
The system changes the parameter of connection type classification to determine alerting behavior. By identifying whether a connection is application-generated or user-generated, the system dynamically adjusts monitoring sensitivity. This parameter-based approach resolves the contradiction by adapting monitoring strictness to the specific connection context rather than applying uniform rules.
2Measurement precision
If connection type determination is implemented, then false positive reduction is achieved, but system complexity increases
Solution Approach 1:
The patent introduces an intermediary component (the security system/module) that sits between the database server and clients. This intermediary automatically determines connection types and applies appropriate monitoring rules, eliminating the need for manual analysis and reducing overall system complexity despite adding a monitoring layer. The intermediary handles the complexity internally while presenting a simplified interface.
3Measurement precision
If monitoring rules are applied based on query type, then detection accuracy is improved, but processing time increases
Solution Approach 1:
The system performs preliminary classification of connections as application-generated or user-generated at the point of connection establishment. This preliminary action allows the system to pre-determine which monitoring rules will apply, avoiding the need for complex real-time analysis of each query. The classification is done once per connection, not per query, significantly reducing processing overhead while maintaining high detection accuracy.
Data Source
AI summary
A method by a security system for detecting malicious attempts to access a decoy database object in a database. The database includes database objects accessible by clients of the database called database clients. The method includes detecting access to a decoy database object of the database is being attempted by a database client over a connection to the database, where the decoy database object is a database object that is created for the purpose of deceiving an attacker as opposed to being a legitimate database object, determining that the connection is of an application connection type, where the application connection type is a type of connection over which queries generated by a database client are submitted, and responsive to the determination that the connection is of the application connection type, causing an alert to be generated.