Detecting attacks on databases based on transaction characteristics determined from analyzing database logs

A set of one or more non-transitory computer readable storage media storing instructions which, when executed by one or more processors of one or more computing devices, cause the one or more computing devices to perform operations for detecting attacks on one or more databases, the operations comprising:

• analyzing database logs of one or more databases to determine transaction characteristics of each of the one or more databases, wherein the database logs include records of transactions made against the one or more databases;
• selecting, for each of a plurality of database accesses made by database clients to the one or more databases, one or more security rules to apply to that database access, wherein different security rules are selected for different ones of the plurality of database accesses depending on the determined transaction characteristics of the database being accessed;
• and
• causing, for each of the plurality of database accesses, the one or more security rules selected for that database access to be applied to that database access.

A computing device configured to detect attacks on one or more databases, the computing device comprising:

• one or more processors;
• and
• a non-transitory machine-readable storage medium having instructions stored therein, which when executed by the one or more processors, causes the computing device to:
• analyze database logs of one or more databases to determine transaction characteristics of each of the one or more databases, wherein the database logs include records of transactions made against the one or more databases;
• select, for each of a plurality of database accesses made by database clients to the one or more databases, one or more security rules to apply to that database access, wherein different security rules are selected for different ones of the plurality of database accesses depending on the determined transaction characteristics of the database being accessed;
• and
• cause, for each of the plurality of database accesses, the one or more security rules selected for that database access to be applied to that database access.