Abstract: A database protection system (DPS) detects anomalies in real time without reliance on discrete security rules, instead relying on a machine learning-based approach. In particular, a Bayesian machine learning model is trained on a set of database protocol metadata (DPM) that the system collects during its runtime operation. Typically, a set of DPM parameters is protocol-specific. The approach herein presumes that DPM parameters are not independent, and that their conditional dependencies (as observed from the database connections) can be leveraged for anomaly detection. To that end, the machine learning model is trained to detect dominant (repeating) patterns of connection DPM parameters. Once trained, the model is then instantiated in the DPS and used to facilitate anomaly detection by identifying connections that do not conform to these patterns, i.e. that represent unusual connection DPM parameters.

Abstract: A network protection system (NPS) is augmented to provide additional functionality—preferably within the SSL/TLS connection at the OSI presentation layer—to enable efficient management and handling of security-violating client connections. When the NPS determines to suspend a suspect application client connection, the NPS modifies the request (the TLS encrypted packet) at a random offset to include a random byte value. When the modified request is then received at the server, a TLS decryption error occurs. In response, the server drops the request gracefully and, in particular, a termination response is returned from the server to the NPS, which then passes the termination response back to the requesting client.

Abstract: A security system protecting a monitored system (e.g., a database server) is configured to self-update (extend) a statement/command parser grammar, dynamically. To accomplish this, the security system uses the monitored system itself as a syntax validator (on the parser's behalf), and without requiring any changes or modifications to the monitored server. In one embodiment, the security system comprises a protocol analyzer and the parser. The protocol analyzer extracts a statement/command from a received request and passes it to the parser. If no parser syntax error is found, the statement/command is validated against a security policy. If a parser syntax error occurs, however, the system examines a response from the monitored system to determine whether the parser syntax error is a “false positive.” If so, the parser then self-extends its own grammar automatically to correct for the parser syntax error. Once its grammar is updated, the parser is then able to process the original request.

Abstract: A database protection system (DPS) is augmented to enable efficient handling of security-violating database client connections. To this end, when the DPS determines to suspend a suspect database client connection several actions are taken. The DPS drops the request and sends a database protocol-specific message to the database server; upon receiving an acknowledgment, the DPS closes the associated transport layer connection mechanism The DPS then initiates an interaction with the client, preferably an exchange of periodic messages (e.g., keep-alive messages) configured to maintain the client in a suspended state. While in this state, the client does not detect any problem with the application or the connection and thus does not try to reconnect to the database server. The DPS then performs an additional assessment/investigation of the violation even as the connection remains open, but suspended. Further action is then taken depending on the results of this evaluation.

Abstract: A technique to protect a cloud database located at a database server and accessible from a database client. In this approach, a communication associated with a database session is intercepted. A hostname or network address associated with the communication is then evaluated to determine whether such information can be found in or otherwise derived from data in a database protocol packet associated with the database session. The information typically is placed there unavoidably by the cloud database client and normally cannot be spoofed by a process that does not understand or speak the proper database protocol semantics. Upon a mismatch, the database session is flagged as being potentially associated with a man-in-the-middle (MITM), in which case a given action may then be taken with respect to the database session that is then active. The technique provides for a MITM checkpoint in a cloud database service environment.

Abstract: A technique to protect a cloud database located at a database server and accessible from a database client. In this approach, a communication associated with a database session is intercepted. A hostname or network address associated with the communication is then evaluated to determine whether such information can be found in or otherwise derived from data in a database protocol packet associated with the database session. The information typically is placed there unavoidably by the cloud database client and normally cannot be spoofed by a process that does not understand or speak the proper database protocol semantics. Upon a mismatch, the database session is flagged as being potentially associated with a man-in-the-middle (MITM), in which case a given action may then be taken with respect to the database session that is then active. The technique provides for a MITM checkpoint in a cloud database service environment.

Abstract: Mechanisms are provided for propagating source identification information from an application front-end system in an application layer to a data layer inspection system associated with a back-end system. An incoming user request is received, at the data layer inspection system, from a gateway system associated with the application front-end system. One or more outgoing statements targeting a back-end system are received at the data layer inspection system. The data layer inspection system accesses a mapping data structure based on the one or more outgoing statements to thereby correlate the one or more outgoing statements with the incoming user request. The data layer inspection system retrieves source identification information associated with the incoming user request based on the correlation of the one or more outgoing statements with the incoming user request. The data layer inspection system performs a data layer inspection operation based on the source identification information.

Abstract: Embodiments are disclosed for a method for identifying large database transactions. The method includes generating a token marker sequence of a database transaction. The token marker sequence includes multiple token markers. The token markers include a token of the database transaction and a position corresponding to the token. The method further includes sorting the token markers based on a probability that the token occurs in a stream of database transactions. Additionally, the method includes reducing a size of the token marker sequence based on a predetermined threshold.

Abstract: A blocking device and a computer-implemented method for preventing an ignition of a vehicle of a novice driver when a supervising driver is not present, the method includes one or more computer processors blocking an ignition circuit of a vehicle. The method includes one or more computer processors receiving a first biometric identification of a supervising driver from a biometric device and determining whether the first biometric identification matches a verified biometric identification of the supervising driver stored in a blocking device. Furthermore, responsive to determining that the first biometric identification matches the verified biometric identification of the supervising driver stored in the blocking device, the method includes one or more computer processors, unblocking the ignition circuit of the vehicle.

Abstract: An example operation may include one or more of receiving a set of structured query language (SQL) queries from one or more software applications, generating a set of SQL syntax trees that correspond to the set of SQL queries, identifying a unique subset of SQL syntax trees among the generated set of SQL syntax trees based on previously obtained SQL syntax trees, and transmitting the unique subset of SQL syntax trees to a computing system.

Abstract: A method to protect sensitive information during a single sign-on (SSO) process flow initiated from a client and directed to an authorization server configured to issue an access token upon verification of a credential. The technique leverages a first proxy that monitors a packet flow issued from the authorization server, and a second proxy that monitors a redirect packet flow issued from the client (in response to the packet flow). A message that includes the access token is modified by the first proxy to include a data string, and the modified message is delivered to the client; concurrently, the first proxy provides the data string/access token pair to the second proxy. When the client receives the modified message, it issues a response (that includes the data string) back to a resource server. As the response traverses the second proxy, it removes the data string and re-inserts the access token, and the resulting modified response is forwarded to the resource server.

Abstract: A computer system, in response to intercepting a database server response with a result set issued by a database server in response to a database query received by the database server, extracts a selection of data from the result set, the selection of data identifying dynamic query elements of the dynamic database query as constructed by the database server at runtime. The database activity monitoring service determines whether the dynamic query elements comply with any security policies. The database activity monitoring service, in response to determining that the dynamic query elements fail to comply with any security policies, issues a security alert.

Abstract: A network protection system (NPS) is augmented to determine and apply security information for a host on a network. The NPS is configured to monitor the host. In response to an occurrence, e.g., the host requesting a network host address, the NPS dynamically determines the security information and encodes it in a portion of the IP address that is assigned. The particular portion of the IP address that is configured for the security information is identified according to variable-length subnet masking (VLSM) notation and, in particular, by including an additional host identifier subdivision that identifies the portion that carries the relevant security data. The security information (e.g., a rank) is encoded in a bitmask. An IP address that has been extended in this manner is then provided on the network, where it is readily-evaluated by other applications and systems that recover the security information by simply applying the bitmask to the IP address.

Abstract: A network protection system (NPS) is augmented to provide additional functionality—preferably within the SSL/TLS connection at the OSI presentation layer—to enable efficient management and handling of security-violating client connections. When the NPS determines to suspend a suspect application client connection, the NPS modifies the request (the TLS encrypted packet) at a random offset to include a random byte value. When the modified request is then received at the server, a TLS decryption error occurs. In response, the server drops the request gracefully and, in particular, a termination response is returned from the server to the NPS, which then passes the termination response back to the requesting client.

Abstract: A database protection system (DPS) is configured to dynamically-optimize security rule validation throughput based on evaluating resource consumption data collected from prior validations. In particular, the DPS analyzes collected resource consumption information and determines which security rules in a set should then be active. To this end, the DPS is configured with multiple security rules engines (SREs), and each is configured to evaluate the same set of security rules. When an SRE applies a validation (to a request or response flow), an associated collector collects and analyzes associated resource consumption data. This data is provided to an optimizer, which receives similar resource consumption data from other SREs. Based on the resource consumption data collected from the SRE collector(s), the optimizer dynamically optimizes security rules validation in real-time, e.g., by dynamically switching on or off given security rule(s) in the set of security rules at given one(s) of the SREs.

Abstract: A database protection system (DPS) is augmented to enable efficient handling of security-violating database client connections. To this end, when the DPS determines to suspend a suspect database client connection several actions are taken. The DPS drops the request and sends a database protocol-specific message to the database server; upon receiving an acknowledgment, the DPS closes the associated transport layer connection mechanism The DPS then initiates an interaction with the client, preferably an exchange of periodic messages (e.g., keep-alive messages) configured to maintain the client in a suspended state. While in this state, the client does not detect any problem with the application or the connection and thus does not try to reconnect to the database server. The DPS then performs an additional assessment/investigation of the violation even as the connection remains open, but suspended. Further action is then taken depending on the results of this evaluation.

Abstract: An application server environment that uses connection pooling is augmented to include a database access control system having a database firewall. When the database firewall detects a security violation with respect to a request received via a pooled connection, the firewall skips over (i.e. do not forward) the violating request and instead creates an artificial error database protocol packet corresponding to the application request. The database firewall then sends the error database protocol packet as a response back to the application, using the pool connection. The application receives the database error as a response to the security violating request, and it responds by releasing the connection of the policy violation database user. By releasing the pool connection is this manner, the performance of other applications (or other clients) using the connection pool is not impacted. Preferably, the error packets include no sensitive information.

Abstract: A security system that monitors requests to a protected resource is configured to determine that a syntactically-invalid language statement in a request is one that should be treated as a “security high risk” statement (SHRS) because it has a probability of containing sensitive data. A machine language that defines the structure and syntax of the language statements used by a client-server application may have multiple SHRSs. SHRSs are identified in advance by syntactical analysis of the language statements that comprise the machine language. The security system stores (or can otherwise obtain) a representation of each of the set of these high risk statements. In response to detecting that a request has a syntactically-invalid language statement, the system determines whether the invalid language statement has a measure of similarity sufficiently close to any of statement in the SHRS set. Upon a positive determination, an appropriate security action is taken to ensure sensitive data is not exposed.

Abstract: A security system protecting a monitored system (e.g., a database server) is configured to self-update (extend) a statement/command parser grammar, dynamically. To accomplish this, the security system uses the monitored system itself as a syntax validator (on the parser's behalf), and without requiring any changes or modifications to the monitored server. In one embodiment, the security system comprises a protocol analyzer and the parser. The protocol analyzer extracts a statement/command from a received request and passes it to the parser. If no parser syntax error is found, the statement/command is validated against a security policy. If a parser syntax error occurs, however, the system examines a response from the monitored system to determine whether the parser syntax error is a “false positive.” If so, the parser then self-extends its own grammar automatically to correct for the parser syntax error. Once its grammar is updated, the parser is then able to process the original request.

Abstract: A database access control system is augmented to enable an external security device to fully assess a database query against a security policy even when the device does not obtain (or otherwise misses) session information that is needed to facilitate that check. Upon receipt from a local agent of a database protocol packet to be examined, the device determines whether any session information needed for the evaluation is unavailable or is otherwise missing. If so, the device extracts metadata from the database protocol packet and generates a separate request back to the agent based on the extracted metadata. The agent then uses information in the separate request to obtain the unavailable or missing session information and, upon its receipt, forwards that information to the device. Upon receiving the additional session information that it needs, the device performs its usual security policy validation on the original database query (as augmented with the additional information returned by the agent).