# US 12,111,912 B2 · Malicious database request identification

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,111,912 B2
- Document ID: US12111912B2
- Status: Granted
- Kind: B2
- Application number: 16/086,205
- Filed: 2017-03-03
- Published: 2020-09-24
- Granted: 2024-10-08
- Earliest claimed: 2016-03-30
- Assignees: British Telecommunications public limited company
- Applicants: British Telecommunications Public Limited Company
- Inventors: Paul Fagan; Nigel Bell
- Web page: https://patentgrep.com/patent/US12111912B2

## CPC

- G06F 21/50: Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F 16/245: Query processing
- G06F 18/22: Matching criteria, e.g. proximity measures
- G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities}
- G06F 21/6227: {where protection concerns the structure of data, e.g. records, types, queries}
- H04L 2463/141: Denial of service attacks against endpoints in a network
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A computer implemented method to identify a malicious database request including receiving a database query for retrieving data from a database; classifying the received query based on query instructions contained in the query to identify a class of query for the query, the class of query having associated attributes defining expected characteristics of queries of the class when executed by the database; monitoring characteristics of the received query executed to retrieve data from the database; and responsive to a determination that the monitored characteristics deviate from the expected characteristics, identifying the query as malicious.

## Claims

### Claim 1

A computer implemented method to identify, by a database driver proxy including computing hardware of at least one processor and memory operably coupled to the at least one processor, a malicious database request originating from a software application, the database driver proxy communicatively coupled between the software application and a target database of the malicious database request, the method comprising:
the database driver proxy receiving a query from the software application for retrieving data from the target database;
before execution of the query, the database driver proxy classifying the query based on instructions contained in the query to identify a class of query for the query, the class of query having associated attributes defining expected characteristics of queries of the class when the query is executed by the target database;
the database driver proxy monitoring characteristics of the query execution when the query is executed by the target database;
the database driver proxy determining that the monitored characteristics deviate from the expected characteristics by an extent equal to or exceeding a predetermined threshold and identifying the query as malicious; and
the database driver proxy implementing at least one protective measure in response to the identifying, wherein the at least one protective measure includes rejecting subsequent queries belonging to a same class as the query and having attributes determined to be similar to attributes of the query based on a predetermined threshold degree of similarity of attributes.

### Claim 2 (depends on 1)

The method of claim 1, wherein the class of query further comprises a class query including the instructions of the query and the expected characteristics are defined based on execution of the class query.

### Claim 3 (depends on 1)

The method of claim 1, wherein, responsive to the determining, the software application is identified as a malicious application.

### Claim 4 (depends on 3)

The method of claim 3, wherein the at least one protective measure includes rejecting subsequent queries received from the identified malicious application.

### Claim 5

A computer system comprising:
a processor and memory storing computer program code such that the processor and memory are configured to operate as a database driver proxy communicatively coupled between a software application and a target database of a malicious database request to identify the malicious database request originating from the software application by:
receiving a query from the software application for retrieving data from the target database,
classifying the query prior to execution of the query based on instructions contained in the query to identify a class of query for the query, the class of query having associated attributes defining expected characteristics of queries of the class when executed by the target database,
monitoring characteristics of execution of the query by the target database,
determining that the monitored characteristics deviate from the expected characteristics by an extent equal to or exceeding a predetermined threshold and identifying the query as malicious, and
implementing at least one protective measure, wherein the at least one protective measure includes rejecting subsequent queries belonging to a same class as the query and having attributes determined to be similar to attributes of the query based on a predetermined threshold degree of similarity of attributes.

### Claim 6 (depends on 1)

A non-transitory computer readable storage medium storing a computer program element comprising computer program code to, when loaded into a computer system and executed thereon, cause the computer to perform the method as claimed in claim 1.