Malicious database request identification

A computer implemented method to identify, by a database driver proxy including computing hardware of at least one processor and memory operably coupled to the at least one processor, a malicious database request originating from a software application, the database driver proxy communicatively coupled between the software application and a target database of the malicious database request, the method comprising:

• the database driver proxy receiving a query from the software application for retrieving data from the target database;
• before execution of the query, the database driver proxy classifying the query based on instructions contained in the query to identify a class of query for the query, the class of query having associated attributes defining expected characteristics of queries of the class when the query is executed by the target database;
• the database driver proxy monitoring characteristics of the query execution when the query is executed by the target database;
• the database driver proxy determining that the monitored characteristics deviate from the expected characteristics by an extent equal to or exceeding a predetermined threshold and identifying the query as malicious;
• and
• the database driver proxy implementing at least one protective measure in response to the identifying, wherein the at least one protective measure includes rejecting subsequent queries belonging to a same class as the query and having attributes determined to be similar to attributes of the query based on a predetermined threshold degree of similarity of attributes.