# US 2021/0344698 A1 · Selective database logging with smart sampling > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0344698 A1 - Document ID: US20210344698A1 - Status: Published application - Kind: A1 - Application number: 17/306,824 - Filed: 2021-05-03 - Published: 2021-11-04 - Earliest claimed: 2018-12-13 - Assignees: Imperva, Inc. - Applicants: Imperva, Inc. - Inventors: Ehud ESHET; Ophir BLEIBERG - Web page: https://patentgrep.com/patent/US20210344698A1 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F 16/906: Clustering; Classification - H04L 41/024: {using relational databases for representation of network management data, e.g. managing via structured query language [SQL]} - H04L 41/0816: the condition being an adaptation, e.g. in response to network events - H04L 43/02: Capturing of monitoring data - H04L 43/04: Processing captured monitoring data, e.g. for logfile generation - H04L 43/062: related to network traffic - H04L 43/16: Threshold monitoring - H04L 47/2483: involving identification of individual flows - H04L 47/83: based on usage prediction - H04L 47/2441: relying on flow classification, e.g. using integrated services [IntServ] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method by a security analysis server to generate a traffic monitoring rule. The method includes receiving, from a database agent because of a current configuration of the database agent, counts of an amount of traffic sent over a first set of one or more of the database connections being monitored by the database agent and generating a traffic monitoring rule that indicates database connections for which the database agent is to send counts of an amount of traffic, rather than all the traffic, sent over those database connections to the security analysis server because those database connections have been determined by the security analysis server to be of an application database connection type based on an analysis by the security analysis server of the counts. The method further includes applying the traffic monitoring rule by sending instructions to the database agent to alter the current configuration. ## Claims ### Claim 1 A method by a database agent implemented by one or more electronic devices that monitors database connections established between one or more database clients and one or more databases, wherein the database agent is communicatively coupled to a security analysis server, the method comprising: sending, to the security analysis server because of a current configuration of the database agent, a count of an amount of traffic, rather than all traffic, sent over each database connection in a first set of one or more of the database connections being monitored by the database agent; receiving, from the security analysis server, an instruction to send to the security analysis server a count of an amount of traffic, rather than all the traffic, sent over each database connection in a second set of one or more of the database connections being monitored by the database agent that have been determined by the security analysis server to be of an application database connection type and to send to the security analysis server traffic sent over other database connections; and responsive to receiving the instruction, sending, to the security analysis server, the count of the amount of traffic, rather than all the traffic, sent over each database connection in the second set of one or more database connections and sending to the security analysis server traffic sent over the other database connections. ### Claim 2 (depends on 1) The method of claim 1, further comprising: sending, to the security analysis server because of the current configuration of the database agent, traffic sent over a third set of one or more of the database connections being monitored by the database agent. ### Claim 3 (depends on 1) The method of claim 1, further comprising: sending, to the security analysis server, a sample of traffic sent over each database connection in the first set of one or more database connections. ### Claim 4 (depends on 3) The method of claim 3, wherein the security analysis server uses the samples of traffic to determine connection attributes of each database connection in the first set of one or more database connections. ### Claim 5 (depends on 3) The method of claim 3, wherein the security analysis server sends the samples of traffic to a database connection type classifier that is to classify the database connections in the first set of one or more database connections as being of the application database connection type or a non-application database connection type based on the samples of traffic, wherein the application database connection type is a type of database connection over which application-generated queries are submitted and the non-application database connection type is a type of database connection over which ad-hoc queries are submitted. ### Claim 6 (depends on 1) The method of claim 1, wherein the instruction indicates the second set of one or more database connections using database connection identifiers. ### Claim 7 (depends on 1) The method of claim 1, further comprising: sending, to the security analysis server along with the counts of the amount of traffic sent over the database connections in the first set of one or more database connections, database connection identifiers of the database connections in the first set of one or more database connections. ### Claim 8 (depends on 1) The method of claim 1, further comprising: responsive to detecting a new database connection, sending, to the security analysis server, traffic sent over the new database connection. ### Claim 9 (depends on 1) The method of claim 1, wherein the counts of the amount of traffic sent over the database connections in the second set of one or more database connections encompass inbound traffic and outbound traffic. ### Claim 10 A set of one or more non-transitory computer readable storage media storing instructions which, when executed by one or more processors of one or more electronic devices implementing a database agent that is communicatively coupled to a security analysis server and that monitors database connections established between one or more database clients and one or more databases, causes the database agent to perform operations comprising: sending, to the security analysis server because of a current configuration of the database agent, a count of an amount of traffic, rather than all traffic, sent over each database connection in a first set of one or more of the database connections being monitored by the database agent; receiving, from the security analysis server, an instruction to send to the security analysis server a count of an amount of traffic, rather than all the traffic, sent over each database connection in a second set of one or more of the database connections being monitored by the database agent that have been determined by the security analysis server to be of an application database connection type and to send to the security analysis server traffic sent over other database connections; and responsive to receiving the instruction, sending, to the security analysis server, the count of the amount of traffic, rather than all the traffic, sent over each database connection in the second set of one or more database connections and sending to the security analysis server traffic sent over the other database connections. ### Claim 11 (depends on 10) The set of one or more non-transitory computer readable storage media of claim 10, wherein the operations further comprise: sending, to the security analysis server because of the current configuration of the database agent, traffic sent over a third set of one or more of the database connections being monitored by the database agent. ### Claim 12 (depends on 10) The set of one or more non-transitory computer readable storage media of claim 10, wherein the operations further comprise: sending, to the security analysis server, a sample of traffic sent over each database connection in the first set of one or more database connections. ### Claim 13 (depends on 12) The set of one or more non-transitory computer readable storage media of claim 12, wherein the security analysis server uses the samples of traffic to determine connection attributes of each database connection in the first set of one or more database connections. ### Claim 14 (depends on 12) The set of one or more non-transitory computer readable storage media of claim 12, wherein the security analysis server sends the samples of traffic to a database connection type classifier that is to classify the database connections in the first set of one or more database connections as being of the application database connection type or a non-application database connection type based on the samples of traffic, wherein the application database connection type is a type of database connection over which application-generated queries are submitted and the non-application database connection type is a type of database connection over which ad-hoc queries are submitted. ### Claim 15 (depends on 10) The set of one or more non-transitory computer readable storage media of claim 10, wherein the instruction indicates the second set of one or more database connections using database connection identifiers. ### Claim 16 An electronic device configured to implement a database agent that monitors database connections established between one or more database clients and one or more databases, wherein the database agent is communicatively coupled to a security analysis server, the electronic device comprising: one or more processors; and a non-transitory machine-readable storage medium having instructions stored therein, which when executed by the one or more processors, cause the database agent to: send, to the security analysis server because of a current configuration of the database agent, a count of an amount of traffic, rather than all traffic, sent over each database connection in a first set of one or more of the database connections being monitored by the database agent, receive, from the security analysis server, an instruction to send to the security analysis server a count of an amount of traffic, rather than all the traffic, sent over each database connection in a second set of one or more of the database connections being monitored by the database agent that have been determined by the security analysis server to be of an application database connection type and to send to the security analysis server traffic sent over other database connections, and responsive to receiving the instruction, send, to the security analysis server, the count of the amount of traffic, rather than all the traffic, sent over each database connection in the second set of one or more database connections and sending to the security analysis server traffic sent over the other database connections. ### Claim 17 (depends on 16) The electronic device of claim 16, wherein the instructions, when executed by the one or more processors, further cause the database agent to: send, to the security analysis server because of the current configuration of the database agent, traffic sent over a third set of one or more of the database connections being monitored by the database agent. ### Claim 18 (depends on 16) The electronic device of claim 16, wherein the instructions, when executed by the one or more processors, further cause the database agent to: send, to the security analysis server, a sample of traffic sent over each database connection in the first set of one or more database connections. ### Claim 19 (depends on 18) The electronic device of claim 18, wherein the security analysis server uses the samples of traffic to determine connection attributes of each database connection in the first set of one or more database connections. ### Claim 20 (depends on 16) The electronic device of claim 16, wherein the instruction indicates the second set of one or more database connections using database connection identifiers.