Detecting attacks on databases based on transaction characteristics determined from analyzing database logs

1. A method by a security system implemented by one or more electronic for detecting attacks on one or more databases, the method comprising:

analyzing database logs of one or more databases to determine transaction characteristics of each of the one or more databases, wherein the determined transaction characteristics of each of the one or more databases include whether the number of new interactive users accessing each of the one or more databases converges over time;

selecting, for each of a plurality of database accesses to the one or more databases, one or more security rules to apply to that database access, wherein different security rules are selected for different ones of the plurality of database accesses depending on the determined transaction characteristics of the database being accessed; and

causing, for each of the plurality of database accesses, the one or more security rules selected for that database access to be applied to that database access.

2. The method of claim 1 , wherein a first security rule is selected for database accesses that access a database for which it has been determined that the number of new interactive users accessing the database converges over time, wherein a second security rule is selected for database accesses that access a database for which it has been determined that the number of new interactive users accessing the database does not converge over time, wherein the first security rule is a rule to generate an alert every time an interactive user accesses an application database object and the second security rule is a rule to not generate an alert when an interactive user accesses an application database object.

3. The method of claim 1 , wherein the determined transaction characteristics of each of the one or more databases further include whether the number of new application database objects accessed by interactive users in each of the one or more databases converges over time.

4. The method of claim 3 , wherein a first security rule is selected for database accesses that access a database for which it has been determined that the number of new interactive users accessing the database converges over time and the number of new application database objects accessed by interactive users in the database converges over time, wherein a second security rule is selected for database accesses that access a database for which it has been determined that the number of new interactive users accessing the database converges over time and the number of new application database objects accessed by interactive users in the database does not converge over time, wherein a third security rule is selected for database accesses that access a database for which it has been determined that the number of new interactive users accessing the database does not converge over time and the number of new application database objects accessed by interactive users in the database converges over time, wherein a fourth security rule is selected for database accesses that access a database for which it has been determined that the number of new interactive users accessing the database does not converge over time and the number of new application database objects accessed by interactive users in the database does not converge over time, and wherein the first security rule is a rule to generate an alert every time an interactive user accesses an application database object, the second security rule is a rule to generate an alert only the first time a given database object is accessed by an interactive user, the third security rule is a rule to generate an alert only the first time a given interactive user accesses an application database object, and the fourth security rule is a rule to not generate an alert when an interactive user accesses an application database object.

5. A method by a security system implemented by one or more electronic for detecting attacks on one or more databases, the method comprising:

analyzing database logs of one or more databases to determine transaction characteristics of each of the one or more databases, wherein the determined transaction characteristics of each of the one or more databases include a database type of each of the one or more databases, wherein the database type is one of an Online Transaction Processing Type (OLTP) type database and an Online Analytical Processing (OLAP) type database;

selecting, for each of a plurality of database accesses to the one or more databases, one or more security rules to apply to that database access, wherein different security rules are selected for different ones of the plurality of database accesses depending on the determined transaction characteristics of the database being accessed; and

causing, for each of the plurality of database accesses, the one or more security rules selected for that database access to be applied to that database access.

6. The method of claim 5 , wherein the database logs are analyzed using a database classification model that has been trained using machine learning to classify each of the one or more databases as being an OLTP type database or an OLAP type database.

7. The method of claim 6 , wherein the database classification model classifies each of the one or more database as being an OLTP type database or an OLAP type database based on one or more of access tool distribution, query operation distribution, distribution of the number of operations per user, distribution of query response times, distribution of user types, user concurrency distribution, and textual hints.

8. The method of claim 5 , wherein a first security rule is selected for database accesses that access a database determined to be an OLTP type database, wherein a second security rule is selected for database accesses that access a database determined to be an OLAP type database, and wherein the first security rule is a rule to generate an alert when an interactive user accesses an application database object and the second security rule is a rule to not generate an alert when an interactive user accesses an application database object.

9. A set of one or more non-transitory computer readable storage media storing instructions which, when executed by one or more processors of one or more computing devices, cause the one or more computing devices to perform operations for detecting attacks on one or more databases, the operations comprising:

analyzing database logs of one or more databases to determine transaction characteristics of each of the one or more databases, wherein the determined transaction characteristics of each of the one or more databases include whether the number of new interactive users accessing each of the one or more databases converges over time;

selecting, for each of a plurality of database accesses to the one or more databases, one or more security rules to apply to that database access, wherein different security rules are selected for different ones of the plurality of database accesses depending on the determined transaction characteristics of the database being accessed; and

causing, for each of the plurality of database accesses, the one or more security rules selected for that database access to be applied to that database access.

10. The set of one or more non-transitory computer readable storage media of claim 9 , wherein a first security rule is selected for database accesses that access a database for which it has been determined that the number of new interactive users accessing the database converges over time, wherein a second security rule is selected for database accesses that access a database for which it has been determined that the number of new interactive users accessing the database does not converge over time, wherein the first security rule is a rule to generate an alert every time an interactive user accesses an application database object and the second security rule is a rule to not generate an alert when an interactive user accesses an application database object.

11. The set of one or more non-transitory computer readable storage media of claim 9 , wherein the determined transaction characteristics of each of the one or more databases further include whether the number of new application database objects accessed by interactive users in each of the one or more databases converges over time.

12. A set of one or more non-transitory computer readable storage media storing instructions which, when executed by one or more processors of one or more computing devices, cause the one or more computing devices to perform operations for detecting attacks on one or more databases, the operations comprising:

analyzing database logs of one or more databases to determine transaction characteristics of each of the one or more databases, wherein the determined transaction characteristics of each of the one or more databases include a database type of each of the one or more databases, wherein the database type is one of an Online Transaction Processing Type (OLTP) type database and an Online Analytical Processing (OLAP) type database;

selecting, for each of a plurality of database accesses to the one or more databases, one or more security rules to apply to that database access, wherein different security rules are selected for different ones of the plurality of database accesses depending on the determined transaction characteristics of the database being accessed; and

causing, for each of the plurality of database accesses, the one or more security rules selected for that database access to be applied to that database access.

13. The set of one or more non-transitory computer readable storage media of claim 12 , wherein the database logs are analyzed using a database classification model that has been trained using machine learning to classify each of the one or more databases as being an OLTP type database or an OLAP type database.

14. A computing device configured to detect attacks on one or more databases, the computing device comprising:

one or more processors; and

a non-transitory machine-readable storage medium having instructions stored therein, which when executed by the one or more processors, causes the computing device to:

analyze database logs of one or more databases to determine transaction characteristics of each of the one or more databases, wherein the determined transaction characteristics of each of the one or more databases include whether the number of new interactive users accessing each of the one or more databases converges over time,

select, for each of a plurality of database accesses to the one or more databases, one or more security rules to apply to that database access, wherein different security rules are selected for different ones of the plurality of database accesses depending on the determined transaction characteristics of the database being accessed, and

cause, for each of the plurality of database accesses, the one or more security rules selected for that database access to be applied to that database access.

15. The computing device of claim 14 , wherein the determined transaction characteristics of each of the one or more databases further include whether the number of new application database objects accessed by interactive users in each of the one or more databases converges over time.

16. A computing device configured to detect attacks on one or more databases, the computing device comprising:

one or more processors; and

a non-transitory machine-readable storage medium having instructions stored therein, which when executed by the one or more processors, causes the computing device to:

analyze database logs of one or more databases to determine transaction characteristics of each of the one or more databases, wherein the determined transaction characteristics of each of the one or more databases include a database type of each of the one or more databases, wherein the database type is one of an Online Transaction Processing Type (OLTP) type database and an Online Analytical Processing (OLAP) type database,

select, for each of a plurality of database accesses to the one or more databases, one or more security rules to apply to that database access, wherein different security rules are selected for different ones of the plurality of database accesses depending on the determined transaction characteristics of the database being accessed, and

cause, for each of the plurality of database accesses, the one or more security rules selected for that database access to be applied to that database access.

17. The computing device of claim 16 , wherein the database logs are analyzed using a database classification model that has been trained using machine learning to classify each of the one or more databases as being an OLTP type database or an OLAP type database.

18. The set of one or more non-transitory computer readable storage media of claim 12 , wherein a first security rule is selected for database accesses that access a database determined to be an OLTP type database, wherein a second security rule is selected for database accesses that access a database determined to be an OLAP type database, and wherein the first security rule is a rule to generate an alert when an interactive user accesses an application database object and the second security rule is a rule to not generate an alert when an interactive user accesses an application database object.

19. The computing device of claim 14 , wherein a first security rule is selected for database accesses that access a database for which it has been determined that the number of new interactive users accessing the database converges over time, wherein a second security rule is selected for database accesses that access a database for which it has been determined that the number of new interactive users accessing the database does not converge over time, wherein the first security rule is a rule to generate an alert every time an interactive user accesses an application database object and the second security rule is a rule to not generate an alert when an interactive user accesses an application database object.

20. The computing device of claim 16 , wherein a first security rule is selected for database accesses that access a database determined to be an OLTP type database, wherein a second security rule is selected for database accesses that access a database determined to be an OLAP type database, and wherein the first security rule is a rule to generate an alert when an interactive user accesses an application database object and the second security rule is a rule to not generate an alert when an interactive user accesses an application database object.