Multi-Database Suspicious Activity Detection via Local and Global Evaluation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing database systems face challenges in identifying suspicious or malicious activities, especially when conducted by users with valid credentials, as current solutions are inadequate in distinguishing between normal and abnormal behavior, particularly in multi-database environments where data breaches can occur across databases.
Innovation Solution
A multi-database system performs both local and global evaluations of interactions to identify suspicious activities by combining insights from individual database engines and a global interaction engine, allowing for the identification of sensitive data and differentiation between normal and suspicious activity, even among users with valid credentials, and alerts other databases to potential threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If only local evaluation is performed at individual databases, then the evaluation process is simple and fast, but suspicious activities involving multiple databases cannot be detected
Solution Approach 1:
The system divides the evaluation process into two independent segments: local evaluation performed by individual database engines and global evaluation performed by a central interaction engine. Each segment handles specific aspects of security monitoring, with local evaluation checking individual database interactions and global evaluation analyzing cross-database patterns, thereby achieving comprehensive detection without requiring a monolithic complex system
Solution Approach 2:
The system merges the results of local and global evaluations by combining security scores from both evaluation types to generate an overall suspicious activity determination. This integration allows the system to leverage both the simplicity of local evaluation and the comprehensive detection capability of global evaluation, resolving the contradiction between detection accuracy and system complexity
2Reliability
If only global evaluation is performed across all databases, then comprehensive suspicious activity detection is achieved, but the evaluation process becomes complex and resource-intensive
Solution Approach 1:
The evaluation workload is segmented between local database engines that perform initial independent assessments and a global interaction engine that performs coordinated analysis. This segmentation allows parallel processing of local evaluations across multiple databases, improving overall evaluation efficiency while maintaining comprehensive detection through the subsequent global evaluation phase
Solution Approach 2:
Local evaluations are performed as preliminary actions before global evaluation. Individual databases conduct initial security assessments of their interactions, generating preliminary security scores that are then used by the global interaction engine. This preliminary action reduces the complexity of global evaluation by pre-processing local data, thereby improving overall evaluation efficiency
3Reliability
If traditional security measures are used, then system operation is simple, but suspicious activities by users with valid credentials cannot be distinguished from normal activity
Solution Approach 1:
The system implements feedback mechanisms where security scores from both local and global evaluations are continuously updated and used to adjust future evaluation parameters. The interaction engine receives feedback from local database evaluations and adjusts its global evaluation criteria accordingly, enabling the system to learn from patterns and improve detection accuracy for credential-based attacks without requiring overly complex manual rule sets
Solution Approach 2:
The dual evaluation system serves multiple functions: local evaluation monitors individual database security, global evaluation detects cross-database attack patterns, and together they provide comprehensive security assessment. This multi-functionality allows the system to detect various types of suspicious activities including credential-based attacks using a unified approach, achieving high detection reliability without proportionally increasing system complexity
Data Source
AI summary
Identifying suspicious activity at a database of a multi-database system. A global evaluation of a plurality of interactions associated with a plurality of databases included within the multi-database system may be performed. A local evaluation of a plurality of interactions associated with a particular database of the plurality of databases may also be performed. The plurality of interactions associated with the particular database may comprise a subset of the plurality of interactions associated with the plurality of databases. A combination of both the global evaluation and the local evaluation may be analyzed to thereby identify one or more suspicious activities occurring at the particular database. Based on the analysis of the combination of the global evaluation and the local evaluation, one or more suspicious activities occurring at the particular database may then be identified.