Technical Maturity Profile for Anomalous Database Access Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anomalous database access detection tools fail to accurately identify suspicious activities due to their reliance on static user roles and do not account for changes in technical maturity of users, which can indicate impersonation, shared accounts, or compromised credentials.
Innovation Solution
A method that generates a technical maturity profile of database users based on historical command analysis, using predefined attributes such as clause usage, variable application, and SQL features, to compare with real-time access patterns and flag significant disparities as anomalous.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If static user roles are used for access detection, then the detection system is simple to implement, but the accuracy of identifying suspicious activities deteriorates
Solution Approach 1:
The patent transforms the static user role parameter into a dynamic technical maturity parameter that evolves over time. Instead of using fixed roles, the system continuously updates user profiles based on observed behavior patterns, command complexity, and skill demonstrations, thereby improving detection accuracy without requiring complex manual configuration
Solution Approach 2:
The system implements dynamic user profiling where technical maturity levels are continuously updated based on real-time analysis of database commands and access patterns. This dynamic approach allows the detection system to adapt to legitimate skill development while flagging anomalous changes that indicate compromise, resolving the contradiction between simplicity and accuracy
2Measurement precision
If technical maturity profiling is implemented, then the accuracy of detecting impersonation improves, but the complexity of the detection system increases
Solution Approach 1:
The system performs preliminary actions by continuously building and updating technical maturity profiles during normal operation. Historical command analysis and skill assessment are conducted in advance, so when an anomaly occurs, the system can quickly compare current behavior against the pre-established profile without requiring complex real-time computation
Solution Approach 2:
The detection system uses the users' own historical behavior and command patterns to create their technical maturity profiles. The system self-updates these profiles automatically based on observed actions, eliminating the need for manual configuration or complex external validation mechanisms
Data Source
AI summary
A method by one or more computing devices to detect anomalous accesses to a system. The method includes generating a technical maturity profile of a system user based on analyzing historical commands submitted by the system user to the system and determining whether an access by the system user to the system is anomalous based on determining technical maturity attributes of a command submitted by the system user to perform the access and comparing the technical maturity attributes of the command to the technical maturity profile of the system user.