# US 11,444,923 B2 · Runtime detection of database protocol metadata anomalies in database client connections > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,444,923 B2 - Document ID: US11444923B2 - Status: Granted - Kind: B2 - Application number: 16/942,022 - Filed: 2020-07-29 - Published: 2022-02-03 - Granted: 2022-09-13 - Earliest claimed: 2020-07-29 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Leonid Rodniansky; Shay Harel; Tania Butovsky; Peter Maniatis - Web page: https://patentgrep.com/patent/US11444923B2 ## CPC - H04L 63/0263: {Rule management} - G06F 18/24155: {Bayesian classification} - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06N 5/022: Knowledge engineering; Knowledge acquisition - G06N 7/01: Probabilistic graphical models, e.g. probabilistic networks - G06N 20/00: Machine learning - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract A database protection system (DPS) detects anomalies in real time without reliance on discrete security rules, instead relying on a machine learning-based approach. In particular, a Bayesian machine learning model is trained on a set of database protocol metadata (DPM) that the system collects during its runtime operation. Typically, a set of DPM parameters is protocol-specific. The approach herein presumes that DPM parameters are not independent, and that their conditional dependencies (as observed from the database connections) can be leveraged for anomaly detection. To that end, the machine learning model is trained to detect dominant (repeating) patterns of connection DPM parameters. Once trained, the model is then instantiated in the DPS and used to facilitate anomaly detection by identifying connections that do not conform to these patterns, i.e. that represent unusual connection DPM parameters. ## Claims ### Claim 1 A method to detect anomalous database connections, comprising: monitoring runtime connections associated with one or more database clients; responsive to the monitoring, identifying database protocol metadata (DPM), the database protocol metadata comprising a set of DPM parameters; for each of one or more subsets of the DPM parameters, applying machine learning to values associated with the database protocol metadata, and outputting a model, wherein the model comprises a joint distribution probability associated with a particular one of the subsets of DPM parameters; and identifying a new database connection as anomalous based on the model. ### Claim 2 (depends on 1) The method as described in claim 1 wherein identifying the new database connection as anomalous computes a value of a joint probability for the particular one of the subsets of DPM parameters for the new database connection and compares the computed joint probability value to the joint distribution probability in the model. ### Claim 3 (depends on 1) The method as described in claim 1 further including generating a directed acyclic graph (DAG) associating a least a first DPM parameter and a second DPM parameter. ### Claim 4 (depends on 3) The method as described in claim 3 wherein the first and second DPM parameters are dependent on one another and have conditional dependencies, wherein the joint distribution probability for the subset comprising the first and second DPM parameters is based on the conditional dependencies. ### Claim 5 (depends on 1) The method as described in claim 1 wherein the new database connection is identified as anomalous on-the-fly and without analysis of a security rule. ### Claim 6 (depends on 1) The method as described in claim 1 wherein the database protocol metadata is internal metadata describing a property or attribute of the database protocol connection. ### Claim 7 (depends on 1) The method as described in claim 1 wherein the model output by the machine learning is a Bayesian model. ### Claim 8 Apparatus configured to detect anomalous database connections, comprising: a processor; computer memory holding computer program instructions executed by the processor, the computer program instructions comprising program code configured to: monitor runtime connections associated with one or more database clients; responsive to the monitoring, identify database protocol metadata (DPM), the database protocol metadata comprising a set of DPM parameters; for each of one or more subsets of the DPM parameters, apply machine learning to values associated with the database protocol metadata, and outputting a model, wherein the model comprises a joint distribution probability associated with a particular one of the subsets of DPM parameters; and identify a new database connection as anomalous based on the model. ### Claim 9 (depends on 8) The apparatus as described in claim 8, wherein the program code configured to identify the new database connection as anomalous further comprises program code configured to: compute a value of a joint probability for the particular one of the subsets of DPM parameters for the new database connection; and compare the computed joint probability value to the joint distribution probability in the model. ### Claim 10 (depends on 8) The apparatus as described in claim 8 wherein the program code is further configured to generate a directed acyclic graph (DAG) associating a least a first DPM parameter and a second DPM parameter. ### Claim 11 (depends on 10) The apparatus as described in claim 10 wherein the first and second DPM parameters are dependent on one another and have conditional dependencies, and wherein the joint distribution probability for the subset comprising the first and second DPM parameters is based on the conditional dependencies. ### Claim 12 (depends on 8) The apparatus as described in claim 8 wherein the new database connection is identified as anomalous on-the-fly and without analysis of a security rule. ### Claim 13 (depends on 8) The apparatus as described in claim 8 wherein the database protocol metadata is internal metadata describing a property or attribute of the database protocol connection. ### Claim 14 (depends on 8) The apparatus as described in claim 8 wherein the model output by the machine learning is a Bayesian model. ### Claim 15 A computer program product in a non-transitory computer readable medium, the computer program product holding computer program instructions executed by a processor in a data processing system to detect anomalous database connections, the computer program instructions comprising program code configured to: monitor runtime connections associated with one or more database clients; responsive to the monitoring, identify database protocol metadata (DPM), the database protocol metadata comprising a set of DPM parameters; for each of one or more subsets of the DPM parameters, apply machine learning to values associated with the database protocol metadata, and outputting a model, wherein the model comprises a joint distribution probability associated with a particular one of the subsets of DPM parameters; and identify a new database connection as anomalous based on the model. ### Claim 16 (depends on 15) The computer program product as described in claim 15 wherein the program code configured to identify the new database connection as anomalous further comprises program code configured to: compute a value of a joint probability for the particular one of the subsets of DPM parameters for the new database connection; and compare the computed joint probability value to the joint distribution probability in the model. ### Claim 17 (depends on 15) The computer program product as described in claim 15 wherein the program code is further configured to generate a directed acyclic graph (DAG) associating a least a first DPM parameter and a second DPM parameter. ### Claim 18 (depends on 17) The computer program product as described in claim 17 wherein the first and second DPM parameters are dependent on one another and have conditional dependencies, and wherein the joint distribution probability for the subset comprising the first and second DPM parameters is based on the conditional dependencies. ### Claim 19 (depends on 15) The computer program product as described in claim 15 wherein the new database connection is identified as anomalous on-the-fly and without analysis of a security rule. ### Claim 20 (depends on 15) The computer program product as described in claim 15 wherein the database protocol metadata is internal metadata describing a property or attribute of the database protocol connection. ### Claim 21 (depends on 15) The computer program product as described in claim 15 wherein the model output by the machine learning is a Bayesian model. ### Claim 22 A method to detect anomalous activity associated with an application layer protocol, comprising: monitoring runtime connections associated with one or more clients or services that use the application layer protocol; responsive to the monitoring, identifying protocol-specific metadata comprising a set of protocol-specific parameters at least some of which have conditional dependencies; for each of one or more subsets of the protocol-specific parameters, applying machine learning to values associated with the protocol-specific metadata, and outputting a model, wherein the model comprises a joint distribution probability associated with a particular one of the subsets of protocol-specific parameters; and identifying a new connection as anomalous based on the model.