Classifying users of a database

1. A method for classifying users of a database, the method comprising:

obtaining an activity rate time series describing activity level of a database user versus time;

extracting at least one feature from the activity rate time series, wherein the at least one feature comprises a measure of repetition in the activity level;

determining a type of the database user based on the extracted at least one feature; and

wherein determining the type of the database user comprises determining if the user is a direct user or an application user, wherein the application user aggregates activity of multiple users of the application.

2. The method of claim 1 , wherein the at least one feature further comprises at least one of a mean activity load and a percentage of the time in which the user is active.

3. The method of claim 2 , wherein the measure of repetition in the user activity is calculated by:

performing a Fourier transform on the activity rate time series to produce a transformed series;

detecting spikes in the transformed series; and

measuring a percentage of information in the transformed series which is included in the spikes.

4. The method of claim 3 , wherein the spikes are detected by:

applying a convolution with a smoothing kernel to the transformed series to produce a resultant series; and

determining that a value in the transformed series is a spike if the resultant series is lower than the transformed series by a predetermined factor.

5. The method of claim 1 , comprising:

obtaining a plurality of labeled activity rate time series;

training a machine learning model using the labeled activity rate time series; and

using the trained machine learning model to determine the type of the user based on the extracted features.

6. The method of claim 5 , wherein the machine learning model is a linear regression model.

7. The method of claim 1 , comprising:

applying a first security policy if the user is a first type of user and a second security policy if the user is a second type of user.

8. The method of claim 1 , comprising:

assigning a first significance level to security events associated with a first type of users and a second significance level to security events associated with a second type of user.

9. A method for determining a type of a user of a database, the method comprising:

obtaining a time series describing an activity volume of the user versus time;

extracting a plurality of features from activity rate time series, wherein at least one feature comprises a measure of repetitive behavior of the user;

classifying user to user types based on the extracted feature; and

wherein classifying the user to user types comprises determining if the user is a direct user or an application user, wherein the application user aggregates activity of multiple users of the application.

10. A system for monitoring of movement of data in a computer network, the system comprising:

a memory; and

a processor configured to:

obtain an activity rate time series describing activity level of a database user versus time;

extract at least one feature from the activity rate time series, wherein the at least one feature comprises a measure of repetition in the activity level;

determine a type of the database user based on the extracted at least one feature; and

wherein the processor is configured to determine if the user is a direct user or an application user, wherein the application uses the database user for aggregating activity of multiple users of the application.

11. The system of claim 10 , wherein the at least one feature further comprises at least one of a mean activity load and a percentage of the time in which the user is active.

12. The system of claim 11 , wherein processor is configured to calculate the measure of repetition in the user activity by:

performing a Fourier transform on the activity rate time series to produce a transformed series;

detecting spikes in the transformed series; and

measuring a percentage of information in the transformed series which is included in the spikes.

13. The system of claim 12 , wherein processor is configured to detect the spikes by:

applying a convolution with a smoothing kernel to absolute values of the transformed series to produce a resultant series; and

determining that a value in the transformed series is a spike if the resultant series is lower than the transformed series by a predetermined factor.

14. The system of claim 10 , wherein processor is configured to:

obtain a plurality of labeled activity rate time series;

train a machine learning model using the labeled activity rate time series; and

use the trained machine learning model to determine the type of the user based on the extracted features.

15. The system of claim 14 , wherein the machine learning model is a linear regression model.

16. The system of claim 10 , wherein processor is configured to:

apply a first security policy if the user is a first type of user and a second security policy if the user is a second type of user.

17. The system of claim 10 , wherein processor is configured to:

assign a first significance level to security events associated with a first type of users and a second significance level to security events associated with a second type of user.

18. The system of claim 10 , wherein the processor is further configured to determine if the user is a machine user.