US 12,717,951 B1Granted

Dynamic threat detection for diverse databases

AssigneeAmazon Technologies, Inc.

InventorsAbishek Sankararaman, Sriram Manohar, Joseph Skinner, Saumya Gaurang Shah, Balakrishnan Narayanaswamy, Farnam Mohasseb

Life of this patent

Estimating the term…

patentgrep

Loading patent…

Abstract

Systems and techniques for database threat detection are described. First login data for a first database that includes a first aggregation key may be received. A first counter that tracks first events associated with the first database may be determined. A first value of the first counter associated with at least the first aggregation key may be determined. A first feature value associated with the first aggregation key may be determined using the first value. An aggregated anomaly detection score may be determined by combining the first anomaly detection score and a plurality of other anomaly detection scores. A determination may be made that the first login data represents anomalous database activity for the first database by comparing the aggregated anomaly detection score to a threshold anomaly detection score. First output data indicating that the first login data represents anomalous database activity for the first database may be generated.

Claims20

Dependent claims

A computer-implemented method of database anomaly detection, the method comprising:

receiving first login data for a first database, the first login data comprising a first aggregation key representing an internet protocol (IP) address and a second aggregation key representing an authentication method;
determining a first counter, wherein the first counter tracks failed authorization events;
determining, using the first login data, a value of the first counter for a first time scale, wherein the value of the first counter is associated with a first number of times that the IP address failed authorization during the first time scale;
determining, using the first counter, a first maximum number of times that the IP address failed authorization for the first time scale during a predetermined past time period that is longer than the first time scale;
determining a first anomaly detection score by dividing the first number by the first maximum number;
determining an aggregated anomaly detection score by linearly combining weighted combinations of a plurality of anomaly detection scores, wherein each anomaly detection score of the plurality of anomaly detection scores is associated with a respective feature comprising a unique combination of a counter, at least one aggregation key, and a time scale, wherein the plurality of anomaly detection scores comprises the first anomaly detection score;
determining, by comparing the aggregated anomaly detection score to a threshold anomaly detection score, that the first login data represents anomalous database activity for the first database based on characteristics of the first database;
and
disabling access to the first database by an account associated with the first login data.

6 more elements

A method comprising:

receiving first login data for a first database, the first login data comprising a first aggregation key and a second aggregation key;
determining a first counter, wherein the first counter tracks first events associated with the first database;
determining a first value of the first counter, wherein the first value is associated with at least the first aggregation key;
determining a first anomaly detection score associated with the first aggregation key using the first value;
determining an aggregated anomaly detection score by combining the first anomaly detection score and a plurality of other anomaly detection scores;
determining, by comparing the aggregated anomaly detection score to a threshold anomaly detection score, that the first login data represents anomalous database activity for the first database;
and
generating first output data indicating that the first login data represents anomalous database activity for the first database.

5 more elements

A system comprising:

at least one processor;
and
non-transitory computer-readable memory storing instructions that, when executed by the at least one processor, are effective to cause the at least one processor to:
receive first login data for a first database, the first login data comprising a first aggregation key and a second aggregation key;
determine a first counter, wherein the first counter tracks first events associated with the first database;
determine a first value of the first counter, wherein the first value is associated with at least the first aggregation key;
determine a first anomaly detection score associated with the first aggregation key using the first value;
determine an aggregated anomaly detection score by combining the first anomaly detection score and a plurality of other anomaly detection scores;
determine, by comparing the aggregated anomaly detection score to a threshold anomaly detection score, that the first login data represents anomalous database activity for the first database;
and
generate first output data indicating that the first login data represents anomalous database activity for the first database.

8 more elements

Dependencies are inferred from the claim text.

Facts

Application: 18/750,649Filed 21 Jun 2024
Granted: 25 Aug 2026
Term ends: Not estimatedThe source records don’t support an estimate.

Classification4 codes

G06F 21/6218
Protecting access to data via a platform, e.g. using keys or access control rules: to a system of files or objects, e.g. local or distributed file…
G06F 21/552
Detecting local intrusion or implementing counter-measures: involving long-term monitoring or reporting
G06F 2221/2135
Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for…: metering
G06F
Computing and data processing