International Business Machines Corporation

Leonid Rodniansky

Tania Butovsky

Ron Ben-Natan

Richard Ory Jerrell

Galia Diamant

Dmitri Dodor

Peter Maniatis

Cheng-Ta Lee

Chun-Shuo Lin

Viktor Ginzburg

Mikhail Shpak

Shidong Shan

Christopher J Berube

Sagi Shechter

Shay Harel

Vladislav Langman

An embodiment initiates, by a sensitive stored procedure identification engine, a periodic discovery process on a database server to identify a stored procedure and assign a first sensitivity score to the stored procedure based on a searching of a sensitive data pattern in the stored procedure. The embodiment assigns in real-time, by the sensitive stored procedure identification engine responsive to receiving a stored procedure call by a client over a network, a second sensitivity score to the stored procedure based on a searching of a sensitive data pattern in a response to the stored procedure call. The embodiment compares, by the sensitive stored procedure identification engine, the first sensitivity score and the second sensitivity score. The embodiment determines, by the sensitive stored procedure identification engine based on the comparison, to allow a response to the stored procedure call to the client.

Sensitive stored procedure identification in real-time and without data exposure

Techniques for identifying outlier application connections for computer security are described. These techniques include identifying one or more connections between a client application and one or more services, over a communication network, and determining to switch from an outlier connection learning phase to an outlier connection detection phase based on the identified or more connections, including determining, in real-time and based on a confidence level and a number of previously analyzed connections, to switch to the outlier connection detection phase. The techniques further include determining, based on the switch to the outlier connection detection phase, that a first connection of the identified one or more connections is an outlier connection, and acting to reduce a security risk relating to the first connection.

Identifying outlier application connections to services with controlled confidence level and in real-time

Described are techniques including a computer-implemented method of aggregating a number of authentication failures from a plurality of connection attempts for an application or a service that services a plurality of clients, where respective authentication failures are detected by evaluating encrypted packets of the plurality of connection attempts. The method further comprises determining that the number of authentication failures is greater than a upper bound number of authentication failures, where the upper bound number of authentication failures is determined by an anomalous function using the plurality of connection attempts as input, where the anomalous function is defined, at least in part, by a Chebyshev's bound and a Chernoff bound. The method further comprises generating an alert indicating a potential credential attack against the application or the service.

Identifying credential attacks on encrypted network traffic

A technique to protect a cloud database located at a database server and accessible from a database client. In this approach, a communication associated with a database session is intercepted. A hostname or network address associated with the communication is then evaluated to determine whether such information can be found in or otherwise derived from data in a database protocol packet associated with the database session. The information typically is placed there unavoidably by the cloud database client and normally cannot be spoofed by a process that does not understand or speak the proper database protocol semantics. Upon a mismatch, the database session is flagged as being potentially associated with a man-in-the-middle (MITM), in which case a given action may then be taken with respect to the database session that is then active. The technique provides for a MITM checkpoint in a cloud database service environment.

Man-in-the-middle (MITM) checkpoint in a cloud database service environment

An example operation may include one or more of receiving a set of structured query language (SQL) queries from one or more software applications, generating a set of SQL syntax trees that correspond to the set of SQL queries, identifying a unique subset of SQL syntax trees among the generated set of SQL syntax trees based on previously obtained SQL syntax trees, and transmitting the unique subset of SQL syntax trees to a computing system.

Unique SQL query transfer for anomaly detection

Embodiments are disclosed for a method for identifying large database transactions. The method includes generating a token marker sequence of a database transaction. The token marker sequence includes multiple token markers. The token markers include a token of the database transaction and a position corresponding to the token. The method further includes sorting the token markers based on a probability that the token occurs in a stream of database transactions. Additionally, the method includes reducing a size of the token marker sequence based on a predetermined threshold.

Identifying large database transactions

A security system that monitors requests to a protected resource is configured to determine that a syntactically-invalid language statement in a request is one that should be treated as a 'security high risk' statement (SHRS) because it has a probability of containing sensitive data. A machine language that defines the structure and syntax of the language statements used by a client-server application may have multiple SHRSs. SHRSs are identified in advance by syntactical analysis of the language statements that comprise the machine language. The security system stores (or can otherwise obtain) a representation of each of the set of these high risk statements. In response to detecting that a request has a syntactically-invalid language statement, the system determines whether the invalid language statement has a measure of similarity sufficiently close to any of statement in the SHRS set. Upon a positive determination, an appropriate security action is taken to ensure sensitive data is not exposed.

Enforcing sensitive data protection in security systems

A database protection system (DPS) mitigates injection attacks. DPS receives an unrestricted database query, extract a syntax tree, and evaluates whether it recognizes the query. To this end, DPS applies a hash function over the extracted syntax tree, and then determines whether the resulting hash has been seen by DPS before. If so, DPS retrieves a previously-generated prepared statement associated with the syntax tree, and that prepared statement is then forward to the database server in lieu of sending the original query. If the syntax tree is not recognized, DPS creates a new prepared statement, generates a hash of the syntax tree, and stores the hash and the new prepared statement, and forwards the new prepared statement. The prepared statements are configured based on the native wire protocol used by the database server, and DPS includes additional functionality by which it can learn the semantics of this protocol if necessary.

Reinforcing SQL transactions dynamically to prevent injection attacks

A mechanism is provided for monitoring and controlling data access. Responsive to intercepting a response from a server to a request for information from a client device, a security system agent applies pattern matching using a predefined set of sensitive data pattern rules to identify at least one sensitive data access included in the response. Responsive to identifying at least one sensitive data access matching one or more of the predefined set of sensitive data pattern rules, the security system agent modifies that the request from the client by marking the at least one sensitive data access as sensitive thereby forming a modified request. The security system agent sends the modified request to the security system thereby causing the security system to process the modified request without access the sensitive data associated with the at least one marked sensitive data access.

Data access monitoring and control

A database protection system (DPS) detects anomalies in real time without reliance on discrete security rules, instead relying on a machine learning-based approach. In particular, a Bayesian machine learning model is trained on a set of database protocol metadata (DPM) that the system collects during its runtime operation. Typically, a set of DPM parameters is protocol-specific. The approach herein presumes that DPM parameters are not independent, and that their conditional dependencies (as observed from the database connections) can be leveraged for anomaly detection. To that end, the machine learning model is trained to detect dominant (repeating) patterns of connection DPM parameters. Once trained, the model is then instantiated in the DPS and used to facilitate anomaly detection by identifying connections that do not conform to these patterns, i.e. that represent unusual connection DPM parameters.

Runtime detection of database protocol metadata anomalies in database client connections

A database protection system (DPS) is configured to dynamically-optimize security rule validation throughput based on evaluating resource consumption data collected from prior validations. In particular, the DPS analyzes collected resource consumption information and determines which security rules in a set should then be active. To this end, the DPS is configured with multiple security rules engines (SREs), and each is configured to evaluate the same set of security rules. When an SRE applies a validation (to a request or response flow), an associated collector collects and analyzes associated resource consumption data. This data is provided to an optimizer, which receives similar resource consumption data from other SREs. Based on the resource consumption data collected from the SRE collector(s), the optimizer dynamically optimizes security rules validation in real-time, e.g., by dynamically switching on or off given security rule(s) in the set of security rules at given one(s) of the SREs.

Dynamic balancing of security rules execution in a database protection system

A mechanism that dynamically creates a new access policy for a set of database servers when a policy violation has been identified in a database access response issued by any database in the set. The new access policy is then propagated in real-time and instantiated across the set of database servers so as to inoculate the other database servers and pre-empt any new compromise of information based on the intruder's actions that were found to have produced the policy violation in the first instance. Thus, the approach uses a response policy violation at one database server of a set to trigger generation of a new request access policy that is then instantiated across one or more other database servers. This response policy violation-to-request access policy instantiation occurs in substantially real-time so that the intruder cannot use a prior successful access request to obtain information from other databases using a similar strategy.

Dynamic cybersecurity protection mechanism for data storage devices

A network protection system (NPS) is augmented to determine and apply security information for a host on a network. The NPS is configured to monitor the host. In response to an occurrence, e.g., the host requesting a network host address, the NPS dynamically determines the security information and encodes it in a portion of the IP address that is assigned. The particular portion of the IP address that is configured for the security information is identified according to variable-length subnet masking (VLSM) notation and, in particular, by including an additional host identifier subdivision that identifies the portion that carries the relevant security data. The security information (e.g., a rank) is encoded in a bitmask. An IP address that has been extended in this manner is then provided on the network, where it is readily-evaluated by other applications and systems that recover the security information by simply applying the bitmask to the IP address.

Growing community of inventors

Allston, MA, United States of America

Leonid Rodniansky