Network Traffic Correlation for Database Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
IT administrators face challenges in correlating and managing network traffic flows, particularly in securing web-based database applications from threats like SQL injection and cross-site scripting attacks, and in generating granular data access audit trails.
Innovation Solution
A traffic management computing device identifies network traffic characteristics to correlate and manage subsequent flows, generating granular data-level audit trails and enforcing data access policies, while monitoring and terminating misbehaving user sessions to secure application and database environments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network traffic monitoring and correlation methods are implemented to generate granular audit trails and secure database applications, then security and audit capabilities are improved, but system complexity and processing overhead increase
Solution Approach 1:
The patent introduces an intermediary component that sits between the web application layer and database layer to capture, correlate, and analyze network traffic. This intermediary enables granular audit trail generation and security monitoring without requiring modifications to existing applications or databases, thus improving security while managing system complexity through a dedicated traffic analysis layer
Solution Approach 2:
The patent segments network traffic analysis into distinct layers: web application layer traffic capture, database layer traffic capture, and correlation layer processing. By dividing the monitoring function into separate modular components that operate at different protocol layers, the system achieves comprehensive security monitoring while maintaining manageable complexity through independent, specialized modules
2Measurement precision
If comprehensive network traffic correlation is performed to detect threats like SQL injection and cross-site scripting, then detection accuracy is improved, but processing time and computational resources increase
Solution Approach 1:
The patent implements preliminary action by pre-defining security policies, threat patterns, and correlation rules before traffic analysis begins. Known attack patterns for SQL injection and cross-site scripting are pre-configured, allowing the system to quickly match incoming traffic against these predefined patterns rather than analyzing each packet from scratch, thus improving detection accuracy while reducing processing time
Solution Approach 2:
The patent applies skipping by implementing efficient traffic sampling and selective deep inspection. Not all traffic packets require full analysis - the system skips routine traffic that matches normal patterns and rushes through correlation using pre-computed hashes and signatures, dedicating full processing power only to suspicious or non-matching traffic, thereby maintaining high detection accuracy while minimizing overall processing time
3Loss of information
If granular data-level audit trails are generated with web application attributes, then audit trail detail and traceability are improved, but data storage requirements and processing overhead increase
Solution Approach 1:
The patent applies local quality by selectively capturing and storing only the specific attributes relevant to each type of traffic and security concern. Different audit trail formats and detail levels are used for different data types - web layer attributes for application-level auditing, database layer attributes for data-level auditing. This localized approach to data collection ensures granular audit capability while avoiding uniform over-collection of unnecessary data across all traffic types
Solution Approach 2:
The patent inverts the traditional audit approach by capturing high-level traffic characteristics first at the network layer, then selectively enriching with detailed application and database attributes only when security events are detected or audit requirements demand it. This inversion allows the system to maintain granular audit trails for security-relevant events while avoiding the storage overhead of capturing all detailed attributes for all traffic, thus improving audit quality for critical events while managing overall data volume
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method, non-transitory computer readable medium, and device that identifies network traffic characteristics to correlate and manage one or more subsequent flows includes transmitting a monitoring request comprising one or more attributes extracted from an HTTP request received from a client computing device and a timestamp to a monitoring server to correlate one or more subsequent flows associated with the HTTP request. The HTTP request is transmitted to an application server after receiving an acknowledgement response to the monitoring request from the monitoring server. An HTTP response to the HTTP request is received from the application server. An operation with respect to the HTTP response is performed.