Unauthorized data access detection based on cyber security images
AssigneeInternational Business Machines Corporation
InventorsOfer Biller, Rosa Miroshnikov, David Rozenblat, Oded Sofer
Life of this patent
Estimating the term…
Abstract
In some examples, a system for detecting unauthorized data access can include a processor to detect a suspicious operation to be executed by the system and review a plurality of highlights corresponding to the suspicious operation. The processor can also determine that a predefined cyber security image corresponding to the highlights and the suspicious operation does not exist and generate the predefined cyber security image based on a plurality of sub-cyber security images. Furthermore, the processor can store the predefined cyber security image in a cyber security image repository and prevent the suspicious operation from being executed.
Claims20
A system for detecting unauthorized access of data comprising:
- a hardware processor to:
- detect a suspicious operation to be executed by the system;
- review a plurality of highlights corresponding to the suspicious operation;
- determine that a predefined cyber security image corresponding to the plurality of highlights and the suspicious operation does not exist;
- generate the predefined cyber security image comprising a plurality of sub-cyber security images based on the plurality of highlights;
- store the predefined cyber security image in a cyber security image repository, wherein the predefined cyber security image comprises a server profile indicating a number of records per request corresponding to an unauthorized user accessing a database from a server associated with the server profile;
- prevent the suspicious operation from being executed;
- and
- prevent a second suspicious operation from being executed in response to detecting the second suspicious operation matches the predefined cyber security image.
A method for detecting unauthorized data access comprising:
- detecting, via a hardware processor, a suspicious operation to be executed by the system;
- reviewing, via the hardware processor, a plurality of highlights corresponding to the suspicious operation;
- determining, via the hardware processor, that a predefined cyber security image corresponding to the highlights and the suspicious operation exists;
- generating, via the hardware processor, the predefined cyber security image based on a plurality of sub-cyber security images;
- storing, via the hardware processor, the predefined cyber security image in a cyber security image repository, wherein the predefined cyber security image comprises a server profile indicating a number of records per request corresponding to an unauthorized user accessing a database from a server associated with the server profile;
- preventing, via the hardware processor, the suspicious operation from being executed;
- and
- prevent a second suspicious operation from being executed in response to detecting the second suspicious operation matches the predefined cyber security image.
A computer program product for detecting unauthorized data access, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, wherein the computer readable storage medium is not a transitory signal per se, the program instructions executable by a processor to cause the processor to:
- detect a suspicious operation to be executed by the system;
- review a plurality of highlights corresponding to the suspicious operation;
- determine that a predefined cyber security image corresponding to the highlights and the suspicious operation does not exist;
- generate the predefined cyber security image based on a plurality of sub-cyber security images;
- store the predefined cyber security image in a cyber security image repository, wherein the predefined cyber security image comprises a server profile indicating a number of records per request corresponding to an unauthorized user accessing a database from a server associated with the server profile;
- prevent the suspicious operation from being executed;
- and
- prevent a second suspicious operation from being executed in response to detecting the second suspicious operation matches the predefined cyber security image.
Dependencies are inferred from the claim text.