Database access, monitoring, and control system and method for reacting to suspicious database activities

Abstract

A database access, monitoring, and control system and method monitor database access, detect suspicious database activities, and react to suspicious database activities by initiating one or more control functions. In at least one embodiment, suspicious database activities include activities related to a number of rows of data retrieved in response to one or more queries within a predetermined threshold window of time. Data retrieval row count above a predetermined threshold that represents an anticipated maximum request for legitimate users can indicate a suspicious database activity. In at least one embodiment, the database access, monitoring, and control system and method detects suspicious database activities even if a data requestor has thwarted other security measures or if the data requestor has authorized access but is potentially accessing data inappropriately.