Network Entity Classification Using Access Logs for Database Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional database security tools apply the same security rules for all network entities, leading to ineffective detection of suspicious activities due to differing access patterns among different types of network entities.
Innovation Solution
Classify network entities into types such as personal clients, application servers, and jump servers based on database logs and enterprise directory information, applying tailored security rules to enhance the detection of attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If the same security rules are applied to all network entities, then the security system is simple to implement, but the detection accuracy of suspicious activities deteriorates
Solution Approach 1:
The patent segments network entities into different types (e.g., application servers, database servers, personal clients) based on their access patterns and characteristics. By dividing the homogeneous group of all network entities into heterogeneous subgroups, the system can apply type-specific security rules that match each entity's expected behavior, thereby improving detection accuracy without excessive complexity
Solution Approach 2:
The patent implements local quality by applying different security rules to different types of network entities based on their specific characteristics and expected access patterns. Instead of using a uniform security approach, the system tailors security parameters (such as query complexity limits, connection frequency thresholds, and allowed operations) to each entity type, improving detection precision for suspicious activities
2Measurement precision
If tailored security rules are applied to different network entity types, then the detection accuracy of suspicious activities improves, but the security system complexity increases
Solution Approach 1:
The patent applies preliminary action by pre-classifying network entities into types based on their access patterns, connection characteristics, and behavior profiles before security evaluation. This classification is performed in advance using machine learning models that analyze historical data, allowing the system to prepare appropriate security rules for each entity type ahead of time, reducing real-time processing complexity
Solution Approach 2:
The system implements self-service by automatically classifying network entities and assigning appropriate security rules without requiring manual configuration for each entity. The machine learning model autonomously analyzes access patterns, determines entity types, and configures tailored security parameters, reducing the operational burden and complexity of managing differentiated security policies
3Reliability
If network entities are classified into different types, then false positives are reduced, but the processing time for security evaluation increases
Solution Approach 1:
The patent performs entity classification in advance before security rule application, creating a persistent classification state that can be reused for multiple security evaluations. By determining the network entity type upfront based on access patterns and connection characteristics, the system avoids repeated classification processing during security checks, minimizing additional processing time
Solution Approach 2:
The patent merges the classification and security rule selection processes by integrating the entity type determination directly into the security evaluation workflow. The classification result is combined with the security rule engine to simultaneously determine both the entity type and the appropriate security parameters in a unified processing step, reducing overall processing time
Data Source
AI summary
Disclosed herein is a method by a computing system to classify network entities. The method includes receiving, by a first stage classifier, database logs and enterprise directory information, attempting to classify, by the first stage classifier during a first stage, a plurality of network entities appearing in the database logs into network entity types based on analyzing the database logs and the enterprise directory information, clustering, by a clustering component, the plurality of network entities into groups based on host name, classifying, by a second stage classifier during a second stage, one or more network entities of the plurality of network entities that were not able to be classified during the first stage into network entity types based on group types of the groups that the one or more network entities were clustered into, and outputting a network entity type of each of the plurality of network entities.