Disconnected database data structure protection
Online interaction data between one or more clients and a database server communicating via a network is received. The online interaction data is used to train a data protection machine learning model for detecting a malicious attack. An offline interface for accessing a database data structure is provided, wherein the offline interface is configured to apply the data protection machine learning model trained using the online interaction data to protect the database data structure accessed via the offline interface.
1 . A method, comprising:
receiving, by way of an offline interface provided as part of a disconnected database in an offline mode, a plurality of local calls from one or more application clients, wherein the offline interface, the disconnected database, and the application clients are executing on a same computing device;
generating, via a data protection machine learning model trained using at least online interaction data captured from a network-accessible database, predictions regarding the plurality of local calls, wherein the data protection machine learning model has been trained to predict whether a call is a malicious call or a non-malicious call; and
based on the predictions from the data protection machine learning model, blocking a local call of the plurality of local calls that is predicted to be malicious from accessing the disconnected database, and allowing a local call of the plurality of local calls that is predicted to be non-malicious to access the disconnected database, wherein blocking the local call that is predicted to be malicious from accessing the disconnected database comprises quarantining an application client associated with the local call.
2 . The method of claim 1 , wherein the data protection machine learning model has been trained to predict whether calls to offline interface are malicious calls or non-malicious calls using known malicious attacks.
3 . The method of claim 1 , wherein the data protection machine learning model has been trained to predict whether calls to offline interface are malicious calls or non-malicious calls using interactions corresponding to structure query language (SQL) injection attacks, denial-of-service (DOS) attacks, data modification attacks, or data theft attacks.
4 . The method of claim 1 , wherein the disconnected database initially includes data from a network-accessible database server.
5 . The method of claim 1 , wherein the offline interface comprises an application programming interface (API) accessible only to applications executing on the same computing device as the disconnected database.
6 . The method of claim 1 , wherein application support for the offline interface is provided via a software development kit (SDK).
7 . A system comprising:
one or more processors; and
a memory coupled to the one or more processors, wherein the memory is configured to provide the one or more processors with instructions which when executed cause the one or more processors to:
receive, by way of an offline interface provided as part of a disconnected database in an offline mode, a plurality of local calls from one or more application clients, wherein the offline interface, the disconnected database and the application clients are executing on a same computing device;
generate, via a data protection machine learning model trained using at least online interaction data captured from a network-accessible database, predictions regarding the plurality of local calls, wherein the data protection machine learning model has been trained to predict whether a call is a malicious call or a non-malicious call; and
based on the predictions from the data protection machine learning model, block a local call of the plurality of local calls that is predicted to be malicious from accessing the disconnected database, and allowing a local call of the plurality of local calls that is predicted to be non-malicious to access the disconnected database, wherein blocking the local call that is predicted to be malicious from accessing the disconnected database comprises quarantining an application client associated with the local call.
8 . The system of claim 7 , wherein the data protection machine learning model has been trained to predict whether calls to the offline interface are malicious calls or non-malicious calls using known malicious attacks.
9 . The system of claim 7 , wherein the data protection machine learning model has been trained to predict whether calls to the offline interface are malicious calls or non-malicious calls using interactions corresponding to structure query language (SQL) injection attacks, denial-of-service (DOS) attacks, data modification attacks, or data theft attacks.
10 . The system of claim 7 , wherein the disconnected database initially includes data from a network-accessible database server.
11 . The system of claim 7 , wherein the offline interface comprises an application programming interface (API) accessible only to applications executing on the same computing device as the disconnected database.
12 . A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
receiving, by way of an offline interface provided as part of a disconnected database in an offline mode, a plurality of local calls from one or more application clients, wherein the offline interface, the disconnected database, and the application clients are running on a same computing device;
generating, via a data protection machine learning model trained using at least online interaction data captured from a network-accessible database, predictions regarding the plurality of local calls, wherein the data protection machine learning model has been trained to predict whether a call is a malicious call or a non-malicious call; and
based on the predictions from the data protection machine learning model, blocking a local call of the plurality of local calls that is predicted to be malicious from accessing the disconnected database, and allowing a local call of the plurality of local calls that is predicted to be non-malicious to access the disconnected database, wherein blocking the local call that is predicted to be malicious from accessing the disconnected database comprises quarantining an application client associated with the local call.
13 . The method of claim 1 , wherein the online interaction data are based at least in part on a source property, a location context, a time context, one or more targeted data fields, or changes in connectivity.
14 . The method of claim 1 , wherein using the online interaction data to train the data protection machine learning model includes extracting machine learning features from the online interaction data, wherein the machine learning features correspond to one or more source properties of the online interaction data, one or more destination properties of the online interaction data, or one or more database queries of the online interaction data.
15 . The method of claim 1 , wherein the online interaction data includes anomalous database interaction behavior.
16 . The system of claim 7 , wherein the online interaction data are based at least in part on a source property, a location context, a time context, one or more targeted data fields, or changes in connectivity.
17 . The system of claim 7 , wherein using the online interaction data to train the data protection machine learning model includes extracting machine learning features from the online interaction data, wherein the machine learning features correspond to one or more source properties of the online interaction data, one or more destination properties of the online interaction data, or one or more database queries of the online interaction data.
18 . The system of claim 7 , wherein the online interaction data includes anomalous database interaction behavior.
19 . The method of claim 1 , wherein the disconnected database is a copy of the network-accessible database.
20 . The method of claim 1 , wherein the disconnected database is a version of the network-accessible database.
21 . The method of claim 1 , wherein the disconnected database in the offline mode cannot be accessed via a network operation.