Dynamic Trust Level Determination for Database End-to-End Links
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data firewall systems face challenges in efficiently analyzing vast amounts of data in real-time due to high computational requirements, leading to expensive infrastructure needs and vulnerability to attacks like hijacking, where static whitelisting techniques fail to detect abnormal behavior in previously trusted connections.
Innovation Solution
A dynamic method for determining a trust level of an end-to-end link by compressing message skeletons into constructs, generating histograms, and comparing them to establish a baseline, allowing for periodic re-evaluation of communication patterns to detect anomalies, thereby reducing computational resources and enhancing security analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If comprehensive security analysis is performed on all data transactions in real-time, then security detection capability is improved, but computational resource requirements and infrastructure cost increase significantly
Solution Approach 1:
The patent segments the data analysis process into two distinct phases: a preparation stage that occurs offline to build reference profiles, and an operation stage that occurs in real-time to detect anomalies. This segmentation allows comprehensive analysis to be performed only when necessary (offline), while real-time operations use lightweight comparison operations, thereby reducing computational resource requirements during critical security monitoring periods.
Solution Approach 2:
The patent performs preliminary actions by creating reference profiles of normal communication patterns during an offline preparation stage before actual security monitoring begins. These profiles include baseline histograms of message characteristics that are pre-computed and stored. During real-time operation, the system only needs to compare current messages against these pre-established profiles, dramatically reducing the computational burden during security-critical real-time operations.
2Productivity
If static whitelisting is used for trusted connections, then processing efficiency is improved, but ability to detect attacks like hijacking deteriorates
Solution Approach 1:
The patent transforms the static whitelisting approach into a dynamic system by continuously monitoring message characteristics and comparing them against learned reference profiles. Instead of treating all connections from approved sources as inherently trustworthy, the system dynamically evaluates each message's conformity to expected patterns. This allows the system to maintain high processing efficiency for normal traffic while automatically detecting deviations that indicate attacks like hijacking, thus resolving the contradiction between efficiency and detection capability.
Solution Approach 2:
The patent implements feedback mechanisms where the system continuously monitors communication patterns and compares them against reference profiles. When deviations are detected, the system can trigger alerts or further analysis. This feedback loop enables the system to maintain efficiency for normal operations while providing continuous security verification, allowing detection of attacks that static whitelisting would miss.
3Use of energy by moving object
If message compression and histogram comparison are used, then computational resources are reduced, but measurement precision of security analysis may deteriorate
Solution Approach 1:
The patent extracts only the essential structural characteristics of messages (such as message type, length, timing patterns, and protocol fields) while excluding unnecessary detailed content. This extraction process creates compressed representations that retain the security-relevant features needed for anomaly detection while eliminating redundant information. The reference profiles are built using these extracted features, enabling accurate security analysis with significantly reduced computational resources.
Data Source
AI summary
A system and method for dynamically determining a trust level of an end-to-end link of a computer database, including: in a preparation stage: capturing a first set of messages of an end-to-end link; compressing a skeleton of each message of the first set of messages to generate a construct of each message of the first set of messages, the skeleton includes the message without a value field; creating a characteristic histogram of the constructs of the first set of messages; and during an operation stage: capturing a second set of messages of the end-to-end link; compressing a skeleton of each message of the second set of messages to generate a construct of each of the second set of messages; creating a work histogram of the constructs of the second set of messages; and determining a trust level of the end-to-end link by comparing the work histogram with the characteristic histogram.