Loading patent…
AssigneeInternational Business Machines Corporation
InventorsLeonid Rodniansky, Shay Harel, Tania Butovsky, Peter Maniatis
Estimating the term…
A database protection system (DPS) detects anomalies in real time without reliance on discrete security rules, instead relying on a machine learning-based approach. In particular, a Bayesian machine learning model is trained on a set of database protocol metadata (DPM) that the system collects during its runtime operation. Typically, a set of DPM parameters is protocol-specific. The approach herein presumes that DPM parameters are not independent, and that their conditional dependencies (as observed from the database connections) can be leveraged for anomaly detection. To that end, the machine learning model is trained to detect dominant (repeating) patterns of connection DPM parameters. Once trained, the model is then instantiated in the DPS and used to facilitate anomaly detection by identifying connections that do not conform to these patterns, i.e. that represent unusual connection DPM parameters.
A method to detect anomalous database connections, comprising:
Apparatus configured to detect anomalous database connections, comprising:
A computer program product in a non-transitory computer readable medium, the computer program product holding computer program instructions executed by a processor in a data processing system to detect anomalous database connections, the computer program instructions comprising program code configured to:
A method to detect anomalous activity associated with an application layer protocol, comprising:
Dependencies are inferred from the claim text.