System and method for real-time detection of anomalies in database usage

A method for real-time detection of anomalies occurring in an enterprise computer network, comprising:

• receiving a plurality of heterogeneous data streams from sources in the network, the sources including two levels, first level sources and second level sources,
• wherein the first level sources include one or more selected from a group consisting of agents located at databases;
• agents located at applications;
• audit programs located at user workstations;
• sensors located in the network;
• and sensors located at access points to the network,
• wherein the second level sources include one or more selected from a group consisting of data access, user behavior, computer activity and network activity, and wherein the first level sources monitor event streams of the second level sources and generate data streams indicative of corresponding second level source activity in a uniform format;
• processing the heterogeneous data streams obtained by combining at least two of the first level sources to identify events therein, each event being identified by at least a unique ID, a timestamp, and an event type, wherein the processing of the heterogeneous data streams includes:
• combining at least two of the first level sources into a single data stream;
• and
• operating on the single data stream using an algorithm that identifies spatiotemporal relationships;
• correlating the processed heterogeneous data streams to form an integrated data stream comprising a plurality of identified events;
• detecting the existence and at least one characteristic of an anomaly in the computer network by application of a predetermined model of normalcy and one or more anomaly rules to the integrated data stream comprising the plurality of identified events;
• and
• issuing an alert based on the at least one characteristic of the anomaly.

A method for real-time detection of anomalies occurring in a computer network, comprising:

• receiving a plurality of heterogeneous data streams from sources in the network, the sources including first level sources and second level sources, wherein the first level sources include one or more selected from a group consisting of agents located at databases, agents located at applications, audit programs located at user workstations, sensors located in the network, and sensors located at access points to the network;
• wherein the second level sources include event streams to be analyzed,
• wherein the first level sources monitor the event streams of the second level sources and generate data streams indicative of corresponding second level source activity in a uniform format, and
• wherein each of the heterogeneous data streams is obtained by combining at least two of the first level sources into a data stream;
• processing the heterogeneous data streams to identify events therein, each event being identified by at least a unique ID, a timestamp, and an event type;
• correlating the processed heterogeneous data streams to form an integrated data stream comprising a plurality of identified events;
• detecting the existence and at least one characteristic of an anomaly in the computer network by application of a predetermined model of normalcy and one or more anomaly rules to the integrated data stream comprising the plurality of identified events;
• and
• issuing an alert based on the at least one characteristic of the anomaly.