Delayed replication for protection of replicated databases

1. An apparatus for providing protection for a plurality of data servers configured to provide data replication for a database, the apparatus comprising:

at least one processing circuit configured to:

receive a record that specifies a modification performed on a first version of the database stored on a first data server of the plurality of data servers;

delay replication of the modification indicated by the record in at least a second data server of the plurality of data servers for a length of time specified for the second data server in a security profile;

during the length of time in which replication is delayed, determine a probability that the modification indicated by the record is malicious based on a first plurality of factors and weights for the first plurality of factors indicated in the security profile, the first plurality of factors being indicative of anomalous data access activity;

prevent replication of the modification indicated by the record on a second version of the database stored in the second data server in response to the probability exceeding a threshold level specified in the security profile; and

after the length of time specified for the second data server in the security profile, replicate the modification indicated by the record on the second version of the database stored in the second data server in response to the probability being less than or equal to the threshold level specified in the security profile.

2. The apparatus of claim 1 , wherein the at least one processing circuit is further configured to, delay replication of the modification indicated by the record in a third data server of the plurality of data servers for a length of time specified for the third data server in the security profile, wherein the length of time specified for the third data server is greater than the length of time specified for the second data server and wherein the security profile indicates different weights for the first plurality of factors for the third data server as compared to the second data server.

3. The apparatus of claim 2 , wherein the at least one processing circuit is communicatively coupled to each of the plurality of data servers via a data network, and wherein the determination that the modification is malicious is based on one of different degrees of likely risk indicated in the security profile.

4. The apparatus of claim 2 , wherein the at least one processing circuit includes a first processing circuit in the second data server and a second processing circuit in the third data server, and wherein the security profile of each of the second data server and the third data server includes different respective threshold for determining different degrees of likely risk indicative of anomalous data access activity.

5. The apparatus of claim 4 , wherein the second processing circuit is configured and arranged to

store the records indicating respective modifications performed on the first version of the database; and

in response to one of the records being stored for a second length of time specified for a third data server in the security profile, perform the modification indicated by the record on a third version of the database stored in the third data server.

6. The apparatus of claim 1 , wherein the at least one processing circuit is further configured and arranged to:

determine a first risk level of the modification indicated by the record based upon a first plurality of factors indicated in the security profile, the first plurality of factors being indicative of anomalous data access activity;

perform the modification indicated by the record on the second version of the database in response to the first risk level being less than a first threshold level indicated in the security profile; and

prevent the modification indicated by the record from being performed on the second version of the database in response to the first risk level being greater than or equal to the first threshold level.

7. The apparatus of claim 6 , wherein the at least one processing circuit is further configured and arranged to:

determine a second risk level the modification indicated by the record based upon a second plurality of factors indicated in the security profile;

perform the modification indicated by the record on a third version of the database stored in a third data server of the plurality of data servers in response to the second risk level being less than a second threshold level indicated in the security profile; and

prevent the modification indicated by the record from being performed on the third version of the database in response to the second risk level being greater than or equal to the second threshold level.

8. The apparatus of claim 6 , wherein the at least one processing circuit is further configured to provide, to an authorized user, a notification in response to preventing the modification from being performed.

9. The apparatus of claim 6 , wherein the at least one processing circuit is further configured and arranged to, in response to the first risk level being greater than or equal to the first threshold level:

determine a subset of the plurality of data servers that have not performed the modification indicated by the record;

select a data server in the subset that is most up-to-date; and

undo the modification in one or more of the plurality of data servers that have performed the modification using data stored in the selected data server.

10. The apparatus of claim 6 , wherein:

the first plurality of factors in the security profile includes a historic profile for the modifications; and

the at least one processing circuit is configured and arranged to determine the first risk level based on deviations from the historic profile.

11. A method providing protection for a plurality of data servers configured to provide data replication for a database, the method comprising using at least one processing circuit communicatively coupled to the plurality of data servers:

receiving a record that specifies a modification performed on a first version of the database stored on a first data server of the plurality of data servers;

delaying replication of the modification indicated by the record in at least a second data server of the plurality of data servers for a length of time specified for the second data server in a security profile;

during the length of time in which replication is delayed, determining a probability that the modification indicated by the record is malicious based on a first plurality of factors and weights for the first plurality of factors indicated in the security profile, the first plurality of factors being indicative of anomalous data access activity;

preventing replication of the modification indicated by the record on a second version of the database stored in the second data server in response to the probability exceeding a threshold level specified in the security profile; and

after the length of time specified for the second data server in a security profile, replicating the modification indicated by the record on the second version of the database stored in the second data server in response to the probability being less than or equal to the threshold level specified in the security profile.

12. The method of claim 11 , further comprising delaying replication of the modification indicated by the record in a third data server of the plurality of data servers for a length of time specified for the third data server in the security profile, wherein the length of time specified for the third data server is greater than the length of time specified for the second data server, and wherein the plurality of factors include at least one of: a type of data transaction, a size of data transaction, a frequency of data transactions, a historical pattern of data transactions, and authentication metrics of a user initiating a data transaction.

13. The method of claim 12 , wherein the at least one processing circuit includes a first processing circuit in the second data server and a second processing circuit in the third data server.

14. The method of claim 13 , further comprising, using the second processing circuit:

storing the records indicating respective modifications performed on the first version of the database; and

in response to one of the records being stored for a second length of time specified for a third data server in the security profile, performing the modification indicated by the record on a third version of the database stored in the third data server.

15. The method of claim 11 , further comprising:

determining a first risk level of the modification indicated by the record based upon a first plurality of factors indicated in the security profile, the first plurality of factors being indicative of anomalous data access activity;

performing the modification indicated by the record on the second version of the database in response to the first risk level being less than a first threshold level indicated in the security profile; and

preventing the modification indicated by the record from being performed on the second version of the database in response to the first risk level being greater than or equal to the first threshold level.

16. The method of claim 15 , further comprising:

determining a second risk level the modification indicated by the record based upon a second plurality of factors indicated in the security profile;

performing the modification indicated by the record on a third version of the database stored in a third data server of the plurality of data servers in response to the second risk level being less than a second threshold level indicated in the security profile; and

preventing the modification indicated by the record from being performed on the third version of the database in response to the second risk level being greater than or equal to the second threshold level.

17. The method of claim 15 , further comprising providing, to an authorized user, a notification in response to preventing the modification from being performed.

18. The method of claim 15 , further comprising, in response to the first risk level being greater than or equal to the first threshold level:

determining a subset of the plurality of data servers that have not performed the modification indicated by the record;

selecting a data server in the subset that is most up-to-date; and

undoing the modification in one or more of the plurality of data servers that have performed the modification using data stored in the selected data server.

19. The method of claim 15 , wherein:

the first plurality of factors in the security profile includes a historic profile for the modifications; and

the method further comprises, determining the first risk level based on deviations from the historic profile.

20. The method of claim 15 , wherein the determining of the first risk level includes determining whether the modification matches a signature included in the security profile, the signature being indicative of a malicious deletion.