Method to detect database management system SQL code anomalies
AssigneeSaudi Arabian Oil Company
InventorEmad Mohammad Al-Mousa
Life of this patent
Estimating the term…
Abstract
The present disclosure describes a computer-implemented method that includes: populating a metadata shell database with one or more hash values, wherein: each hash value corresponds to a verified installation of a database system, and the metadata shell database is maintained within a locked-down environment on an enterprise network; and monitoring metadata information of one or more database systems on the enterprise network based on periodically accessing metadata information of one or more database systems; and determining whether a database system on the enterprise network has been compromised based on a hash value of the metadata information of the database system and the one or more hash values from the metadata shell database.
Claims20
A computer-implemented method comprising:
- scanning an enterprise network for a plurality of database systems thereon;
- populating a metadata shell database for the plurality of database systems with hash values, wherein:
- each hash value corresponds to a database system from the plurality of database systems and comprises a metadata hash of a verified installation of the corresponding database system, and
- the metadata shell database is maintained for the plurality of database systems within a locked-down environment on the enterprise network;
- and
- monitoring metadata information of the plurality of database systems on the enterprise network based on periodically accessing metadata information of the plurality of database systems;
- and
- determining whether a database system on the enterprise network has been compromised based on a hash value of the periodically accessed metadata information of the database system and hash values from the metadata shell database.
A computer system comprising one or more processors, wherein the one or more processors are configured to perform operations of:
- scanning an enterprise network for a plurality of database systems thereon:
- populating a metadata shell database for the plurality of database systems with one or more hash values, wherein:
- each hash value corresponds to a database system from the plurality of database systems and comprises a metadata hash of a verified installation of the corresponding database system, and
- the metadata shell database for the plurality of database systems within a locked-down environment on the enterprise network;
- and
- monitoring metadata information of the plurality of database systems on the enterprise network based on periodically accessing metadata information of the plurality of database systems;
- and
- determining whether a database system on the enterprise network has been compromised based on a hash value of the periodically accessed metadata information of the database system and hash values from the metadata shell database.
Dependencies are inferred from the claim text.