Subject Logging for Real-Time Database Access Auditing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing big data processing systems face challenges in auditing user data access, particularly for large organizations with millions of daily transactions, as they struggle to efficiently track and monitor user activity, especially when sensitive information is involved, and lack real-time anomaly detection capabilities.
Innovation Solution
A system and method for subject logging that includes real-time logging of user activity, indexing user access data by predefined fields, and using machine learning for anomaly detection, enabling efficient storage and proactive monitoring of user behavior.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If comprehensive user activity logging is implemented to track all data accesses, then auditing capability and security monitoring are improved, but system complexity and processing overhead increase significantly
Solution Approach 1:
The patent segments the logging process by creating separate log tables for different data types (user activity logs, data access logs, system operation logs) and implements selective logging based on data sensitivity and access patterns. This segmentation allows comprehensive auditing of critical operations while reducing the complexity of managing a single monolithic logging system.
Solution Approach 2:
The system performs preliminary actions by pre-defining log retention policies, pre-establishing indexing strategies for common query patterns, and pre-configuring automated alert thresholds for anomaly detection. These preliminary preparations reduce operational complexity during runtime while maintaining comprehensive auditing capabilities.
2Difficulty of detecting and measuring
If real-time logging and monitoring of user activity is implemented, then anomaly detection capability is improved, but processor load and memory consumption increase
Solution Approach 1:
The patent applies partial action by implementing anomaly detection only for specific high-risk operations and data types rather than monitoring all activities equally. The system uses sampling techniques and threshold-based filtering to focus computational resources on the most critical events, reducing processor load while maintaining effective anomaly detection capability.
Solution Approach 2:
The system performs preliminary actions by pre-establishing baseline behavior patterns and anomaly thresholds during off-peak times. These pre-computed reference values are stored and used for rapid real-time comparison, eliminating the need for complex real-time machine learning models and significantly reducing processor load during actual monitoring operations.
3Measurement precision
If detailed user access data is stored and indexed for comprehensive auditing, then measurement precision of access patterns is improved, but data storage requirements and memory burden increase
Solution Approach 1:
The patent extracts only the essential auditing information from complete user activity records, storing only critical fields (user identifier, timestamp, operation type, data type, access result) rather than all possible activity details. This extraction maintains measurement precision for security auditing while dramatically reducing storage requirements compared to comprehensive logging of all activity data.
Solution Approach 2:
The system segments storage requirements by implementing different retention policies for different log types (e.g., longer retention for security-related logs, shorter retention for routine operations) and using compressed storage formats for historical data. This segmentation allows precise measurement of access patterns for critical operations while reducing overall storage burden through selective retention and compression.
Data Source
AI summary
The present application discloses a method, system, and computer system for monitoring tasks with respect to information stored in a database system. The method includes receiving a request to execute a task with respect to a database, wherein the request is associated with an identifier corresponding to a user that inputs a query for the request; determining whether the task is authorized for the user; in response to a determination that the task is authorized for the user, obtaining a set of information that is to be returned for the task; determining a subset of the set of information, wherein the subset of the set of information comprises one or more parts of the set of information for which the user has access permission; and storing a record of the request to execute the task, wherein the record comprises an indication of the user, and an indication of subset of the set of information.