# US 8,474,036 B2 · Database context-based intrusion detection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,474,036 B2 - Document ID: US8474036B2 - Status: Granted - Kind: B2 - Application number: 12/216,135 - Filed: 2008-06-30 - Published: 2009-12-31 - Granted: 2013-06-25 - Earliest claimed: 2008-06-30 - Assignees: Sentrigo Inc. - Applicants: Slavik Markovich - Inventors: Slavik Markovich - Web page: https://patentgrep.com/patent/US8474036B2 ## CPC - G06F 21/6227: {where protection concerns the structure of data, e.g. records, types, queries} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method for detecting an unauthorized action in a database, the method comprising estimating correlation between a predicted result of an intercepted database statement and at least one context parameter associated with the database statement, wherein lack of correlation indicates the database statement being associated with an unauthorized action. ## Claims ### Claim 1 A computer-based method for detecting an unauthorized action in a database, the method comprising estimating, by a computing device, correlation between a predicted result of an intercepted database statement and at least one context parameter indicating an origin of the database statement, wherein lack of correlation indicates the database statement being associated with an unauthorized action. ### Claim 2 (depends on 1) The method according to claim 1, wherein the estimating of the correlation comprises determining if the predicted result should originate, under normal circumstances, from the at least one context parameter. ### Claim 3 (depends on 1) The method according to claim 1, wherein the estimating of the correlation comprises matching the predicted result and the at least one context parameter with a pre-defined criteria. ### Claim 4 (depends on 1) The method according to claim 1, wherein the predicted result comprises a predicted effect of the database statement on the database. ### Claim 5 (depends on 1) The method according to claim 1, wherein the intercepted database statement comprises a database statement intercepted in a memory of a database server. ### Claim 6 (depends on 1) The method according to claim 1, wherein the intercepted database statement comprises a database statement intercepted in a network channel. ### Claim 7 (depends on 1) The method according to claim 1, wherein the intercepted database statement comprises a Structured Query Language (SQL) statement. ### Claim 8 (depends on 1) The method according to claim 1, wherein the at least one context parameter comprises at least one privilege of a user of the database. ### Claim 9 (depends on 8) The method according to claim 8, wherein the user of the database comprises a user account designated to a database package. ### Claim 10 (depends on 1) The method according to claim 1, wherein the at least one context parameter comprises at least one parameter pertaining to an end-user of an application server associated with the database. ### Claim 11 (depends on 10) The method according to claim 10, wherein the at least one parameter pertaining to the end-user is selected from a group consisting of an Internet Protocol (IP) address, a network identifier, a username, a Uniform Resource Locator (URL), a Hypertext Transfer Protocol (HTTP) request method, a user-agent string, a screen resolution, a window size, a window location, a color depth, a network group, permissions, a domain and an operating system. ### Claim 12 (depends on 1) The method according to claim 1, further comprising preventing execution of the database statement, if the database statement is indicated as being associated with the unauthorized action. ### Claim 13 (depends on 1) The method according to claim 1, further comprising reporting the unauthorized action, if the database statement is indicated as being associated with the unauthorized action. ### Claim 14 A non-transitory database intrusion detector, comprising: a computing device including an interception module adapted to intercept a database statement prior to its execution in a database; an interface module adapted to obtain at least one context parameter indicating an origin of said database statement; and control logic adapted to predict a result of said database statement and to estimate correlation between said at least one context parameter and said result, wherein lack of correlation indicates the database statement being associated with an intrusion to the database. ### Claim 15 (depends on 14) The database intrusion detector according to claim 14, wherein said database statement comprises a database statement intercepted by said interception module in a memory of a database server. ### Claim 16 (depends on 14) The database intrusion detector according to claim 14, wherein said database statement comprises a database statement intercepted by said interception module in a network channel. ### Claim 17 (depends on 14) The database intrusion detector according to claim 14, wherein said database statement comprises a Structured Query Language (SQL) statement. ### Claim 18 (depends on 14) The database intrusion detector according to claim 14, wherein said at least one context parameter comprises at least one privilege of a user of the database. ### Claim 19 (depends on 18) The database intrusion detector according to claim 18, wherein the user of the database comprises a user account designated to a database package. ### Claim 20 (depends on 14) The database intrusion detector according to claim 14, wherein said at least one context parameter comprises at least one parameter pertaining to an end-user of an application server associated with the database. ### Claim 21 (depends on 20) The database intrusion detector according to claim 20, wherein said at least one parameter pertaining to the end-user is selected from a group consisting of an Internet Protocol (IP) address, a network identifier, a username, a Uniform Resource Locator (URL), a Hypertext Transfer Protocol (HTTP) request method, a user-agent string, a screen resolution, a window size, a window location, a color depth, a network group, permissions, a domain and an operating system. ### Claim 22 (depends on 14) The database intrusion detector according to claim 14, wherein said result comprises a predicted effect of said database statement on the database. ### Claim 23 (depends on 14) The database intrusion detector according to claim 14, wherein said estimating of correlation comprises determining if said result should originate, under normal circumstances, from said at least one context parameter. ### Claim 24 (depends on 14) The database intrusion detector according to claim 14, wherein said estimating of correlation comprises matching said result and said at least one context parameter with a pre-defined criteria. ### Claim 25 (depends on 14) The database intrusion detector according to claim 14, wherein said control logic is further adapted to prevent execution of said database statement, if said database statement is indicated as being associated with the unauthorized action. ### Claim 26 (depends on 14) The database intrusion detector according to claim 14, wherein said control logic is further adapted to report the unauthorized action, if said database statement is indicated as being associated with the unauthorized action. ### Claim 27 A computing system comprising: a computing device configured to estimate correlation between a predicted result of an intercepted database statement and at least one context parameter indicating an origin of the database statement, and based on said correlation to determine that the database statement is associated with an unauthorized action. ### Claim 28 (depends on 27) The computing system of claim 27, wherein said computing device is to estimate said correlation by determining if said result should originate, under normal circumstances, from said at least one context parameter. ### Claim 29 (depends on 27) The computing system of claim 27, wherein said computing device is to estimate said correlation by matching said result and said at least one context parameter with a pre-defined criteria. ### Claim 30 (depends on 27) The computing system of claim 27, wherein the at least one context parameter comprises at least one privilege of a user of the database.