Back to results
US 11,379,576 B2Granted
Identification of database intrusion by changes in data tables
AssigneeCapital One Services, LLC
InventorsAustin Walters, Jeremy Goodsitt, Vincent Pham
Life of this patent
Estimating the term…
Abstract
Aspects described herein may allow for the application of an artificial neural network architecture to identify intrusion in a database. Changes to components of a data table of the database may be tracked as a snapshot of the changes over a period of time. Any change in the data table may be associated with a user. Utilizing multiple snapshots, a background substitution technique may be utilized to generate a matrix of the changes to the data table over a period of time. A model having an artificial neural network architecture may utilize the matrix as an input set to identify the user as an unauthorized user accessing the database.
Claims20
A computer-implemented method comprising:
- tracking at least one change in each of a plurality of components corresponding to a change in a row of a data table in a database as a snapshot of the at least one change, wherein the at least one change is associated with a user, wherein the at least one change corresponds to a last record access of the row of the data table in the database;
- establishing a value representative of the at least one change for each of the plurality of components;
- initializing a background subtraction technique on the snapshot using a previous snapshot to generate a matrix representative of the at least one change, wherein the background subtraction technique receives the snapshot, the previous snapshot, and at least one second previous snapshot as inputs, wherein the matrix is a two dimensional vector matrix;
- initializing a model having an artificial neural network architecture and a plurality of model parameters, wherein the artificial neural network architecture comprises an input layer, an output layer, and a plurality of hidden layers, the model configured to detect unauthorized access to the database based on changes to the data table;
- receiving the matrix as an input data set to the model;
- identifying the user as an unauthorized user based on an output data set generated by the model based on the input data set;
- and
- after identifying the user as the unauthorized user, transmitting a notification of the unauthorized user.
5 more elements
A computer-implemented method comprising:
- tracking at least one change in at least one component corresponding to a change in a row of a data table in a database as a snapshot of the at least one change, wherein the at least one change is associated with a user, wherein the at least one change corresponds to a last record access of the row of the data table in the database;
- establishing a value representative of the at least one change for the at least one component;
- initializing a background subtraction technique on the snapshot using a previous snapshot to generate a matrix representative of the at least one change, wherein the matrix comprises pixel intensity values, wherein the initializing the background subtraction technique comprises normalizing the value representative of the at least one change, wherein the background subtraction technique receives the snapshot and the previous snapshot as inputs;
- initializing a model having an artificial neural network architecture and a plurality of model parameters, wherein the artificial neural network architecture comprises an input layer, an output layer, and a plurality of hidden layers, the model configured to detect unauthorized access to the database based on changes to the data table;
- receiving the matrix as an input data set to the model;
- identifying the user as an unauthorized user based on an output data set generated by the model based on the input data set;
- and
- after identifying the user as the unauthorized user, transmitting a notification of the unauthorized user.
5 more elements
An apparatus comprising,
- one or more processors;
- and
- memory storing instructions that, when executed by the one or more processors, cause the apparatus to perform:
- tracking at least one change in each of a plurality of components corresponding to a change in a row of a data table in a database as a snapshot of the at least one change, wherein the at least one change is associated with a user, wherein the at least one change corresponds to a last record access of the row of the data table in the database;
- establishing a value representative of the at least one change for each of the plurality of components;
- initializing a background subtraction technique on the snapshot using a previous snapshot to generate a matrix representative of the at least one change, wherein the background subtraction technique receives the snapshot, the previous snapshot, and at least one second previous snapshot as inputs, wherein the matrix is a two dimensional vector matrix;
- initializing a model having an artificial neural network architecture and a plurality of model parameters, wherein the artificial neural network architecture comprises an input layer, an output layer, and a plurality of hidden layers, the model configured to detect unauthorized access to the database based on changes to the data table;
- receiving the matrix as an input data set to the model;
- identifying the user as an unauthorized user based on an output data set generated by the model based on the input data set;
- and
- after identifying the user as the unauthorized user, transmitting a notification of the unauthorized user.
8 more elements
Dependencies are inferred from the claim text.