Abstract: A method by a security system implemented by one or more electronic for detecting attacks on one or more databases. The method includes analyzing database logs of one or more databases to determine transaction characteristics of each of the one or more databases, selecting, for each of a plurality of database accesses to the one or more databases, one or more security rules to apply to that database access, wherein different security rules are selected for different ones of the plurality of database accesses depending on the determined transaction characteristics of the database being accessed, and causing, for each of the plurality of database accesses, the one or more security rules selected for that database access to be applied to that database access.

Abstract: A method by one or more electronic devices for detecting attacks on one or more databases. The method includes classifying, based on analyzing database logs of the one or more databases, each of a plurality of operating system (OS) accounts used to access the one or more databases into one of a plurality of OS account types, wherein the plurality of OS account types include a human OS account type and a service OS account type. The method further includes using a result of the classification of the plurality of OS accounts to detect attacks on the one or more databases.

Abstract: A method by a security system implemented by one or more electronic devices for detecting attacks on one or more databases hosted by one or more database servers. The method includes classifying, based on analyzing database logs of the one or more databases, a plurality of network entities used to access the one or more databases into different network entity types, where one or more of the plurality of network entities can be classified into the same network entity type and using a result of the classification of the plurality of network entities to detect attacks on the one or more databases.

Abstract: A method by a security system implemented by one or more electronic for detecting attacks on one or more databases. The method includes analyzing database logs of one or more databases to determine transaction characteristics of each of the one or more databases, selecting, for each of a plurality of database accesses to the one or more databases, one or more security rules to apply to that database access, wherein different security rules are selected for different ones of the plurality of database accesses depending on the determined transaction characteristics of the database being accessed, and causing, for each of the plurality of database accesses, the one or more security rules selected for that database access to be applied to that database access.

Abstract: A method by a security system implemented by one or more electronic for detecting attacks on one or more databases. The method includes analyzing database logs of one or more databases to determine transaction characteristics of each of the one or more databases, selecting, for each of a plurality of database accesses to the one or more databases, one or more security rules to apply to that database access, wherein different security rules are selected for different ones of the plurality of database accesses depending on the determined transaction characteristics of the database being accessed, and causing, for each of the plurality of database accesses, the one or more security rules selected for that database access to be applied to that database access.

Abstract: A method by a security system implemented by one or more electronic devices for detecting attacks on one or more databases hosted by one or more database servers. The method includes classifying, based on analyzing database logs of the one or more databases, a plurality of network entities used to access the one or more databases into different network entity types, where one or more of the plurality of network entities can be classified into the same network entity type and using a result of the classification of the plurality of network entities to detect attacks on the one or more databases.

Abstract: A method by a security system implemented by one or more electronic for detecting attacks on one or more databases. The method includes analyzing database logs of one or more databases to determine transaction characteristics of each of the one or more databases, selecting, for each of a plurality of database accesses to the one or more databases, one or more security rules to apply to that database access, wherein different security rules are selected for different ones of the plurality of database accesses depending on the determined transaction characteristics of the database being accessed, and causing, for each of the plurality of database accesses, the one or more security rules selected for that database access to be applied to that database access.