Granted Patent B2

US 12,430,460 · App. 18/244,599 · Granted Sep 30, 2025

Inventors: Leonid Rodniansky (Allston, MA); Mikhail Shpak (New York, NY); Tania Butovsky (Needham, MA); Shidong Shan (Shirley, MA)

Assignee: INTERNATIONAL BUSINESS MACHINES CORPORATION

G06F21/6227

Abstract

Claims (66)

1. A computer-implemented method comprising:

initiating, by a sensitive stored procedure identification engine, a periodic discovery process on a database server to identify a stored procedure and assign a first sensitivity score to the stored procedure based on a searching of a sensitive data pattern in the stored procedure;

assigning in real-time, by the sensitive stored procedure identification engine responsive to receiving a stored procedure call by a client over a network, a second sensitivity score to the stored procedure based on a searching of a sensitive data pattern in a response to the stored procedure call;

comparing, by the sensitive stored procedure identification engine, the first sensitivity score and the second sensitivity score; and

determining, by the sensitive stored procedure identification engine based on the comparison, to allow a response to the stored procedure call to the client.

2. The method of claim 1 , wherein assigning the first sensitivity score further comprises:

extracting a plurality of object names from a stored procedure source associated with the stored procedure;

searching a plurality of collections associated with the plurality of object names for a sensitive data pattern; and

assigning the first sensitivity score based on the searching of the sensitive data pattern.

3. The method of claim 1 , wherein the searching for the sensitive data pattern includes applying at least one of a regular expression, a wildcard search, and a machine learning model.

4. The method of claim 1 , wherein assigning the sensitivity score further comprises:

identifying a first sensitive data pattern in the stored procedure;

identifying a second sensitive data pattern in the stored procedure, the second sensitive data pattern being associated with a higher sensitivity score than the first sensitive data pattern; and

assigning the sensitivity score based on the second sensitive data pattern.

5. The method of claim 1 , wherein comparing the first sensitivity score and the second sensitivity score further comprises:

computing a difference between the first sensitivity score and the second sensitivity score; and

identifying a potential malicious activity responsive to a determination that the difference exceeds a predetermined threshold.

6. The method of claim 5 , further comprising:

determining to allow the response to the stored procedure call to the client responsive to a determination that there is no potential malicious activity.

7. The method of claim 5 , further comprising:

generating an alert responsive to a determination that there is potential malicious activity.

8. The method of claim 1 , further comprising:

determining, responsive to receiving a second stored procedure call by the client for a second stored procedure, whether the second stored procedure has been assigned a first sensitivity score via the discovery process; and

determining to block a response to the second stored procedure call responsive to a determination that the second stored procedure has not been assigned the first sensitivity score via the discovery process.

9. The method of claim 8 , further comprising:

determining whether the second stored procedure has been assigned a second sensitivity score responsive to receiving the second stored procedure call by the client; and

generating an alert responsive to a determination that the second stored procedure has not been assigned the second sensitivity score responsive to receiving the second stored procedure call by the client.

10. A computer program product comprising one or more computer readable storage media, and program instructions collectively stored on the one or more computer readable storage media, the program instructions executable by a processor to cause the processor to perform operations comprising:

initiating, by a sensitive stored procedure identification engine, a periodic discovery process on a database server to identify a stored procedure and assign a first sensitivity score to the stored procedure based on a searching of a sensitive data pattern in the stored procedure;

assigning in real-time, by the sensitive stored procedure identification engine responsive to receiving a stored procedure call by a client over a network, a second sensitivity score to the stored procedure based on a searching of a sensitive data pattern in a response to the stored procedure call;

comparing, by the sensitive stored procedure identification engine, the first sensitivity score and the second sensitivity score; and

determining, by the sensitive stored procedure identification engine based on the comparison, to allow a response to the stored procedure call to the client.

11. The computer program product of claim 10 , wherein assigning a sensitivity score further comprises:

extracting a plurality of object names from a stored procedure source associated with the stored procedure;

searching a plurality of collections associated with the plurality of object names for a sensitive data pattern; and

assigning the first sensitivity score based on the searching of the sensitive data pattern.

12. The computer program product of claim 10 , wherein the searching for the sensitive data pattern includes applying at least one of a regular expression, a wildcard search, and a machine learning model.

13. The computer program product of claim 10 , wherein assigning the sensitivity score further comprises:

identifying a first sensitive data pattern in the stored procedure;

identifying a second sensitive data pattern in the stored procedure, the second sensitive data pattern being associated with a higher sensitivity score than the first sensitive data pattern; and

assigning the sensitivity score based on the second sensitive data pattern.

14. The computer program product of claim 10 , wherein comparing the first sensitivity score and the second sensitivity score further comprises:

computing a difference between the first sensitivity score and the second sensitivity score; and

identifying a potential malicious activity responsive to a determination that the difference exceeds a predetermined threshold.

15. The computer program product of claim 10 , further comprising:

determining, responsive to receiving a second stored procedure call by the client for a second stored procedure, whether the second stored procedure has been assigned a first sensitivity score via the discovery process;

determining to block a response to the second stored procedure call responsive to a determination that the second stored procedure has not been assigned the first sensitivity score via the discovery process;

determining whether the second stored procedure has been assigned a second sensitivity score responsive to receiving the second stored procedure call by the client; and

generating an alert responsive to a determination that the second stored procedure has not been assigned the second sensitivity score responsive to receiving the second stored procedure call by the client.

16. A computer system comprising a processor and one or more computer readable storage media, and program instructions collectively stored on the one or more computer readable storage media, the program instructions executable by the processor to cause the processor to perform operations comprising:

initiating, by a sensitive stored procedure identification engine, a periodic discovery process on a database server to identify a stored procedure and assign a first sensitivity score to the stored procedure based on a searching of a sensitive data pattern in the stored procedure;

assigning in real-time, by the sensitive stored procedure identification engine responsive to receiving a stored procedure call by a client over a network, a second sensitivity score to the stored procedure based on a searching of a sensitive data pattern in a response to the stored procedure call;

comparing, by the sensitive stored procedure identification engine, the first sensitivity score and the second sensitivity score; and

determining, by the sensitive stored procedure identification engine based on the comparison, to allow a response to the stored procedure call to the client.

17. The computer system of claim 16 , wherein assigning a sensitivity score further comprises:

extracting a plurality of object names from a stored procedure source associated with the stored procedure;

searching a plurality of collections associated with the plurality of object names for a sensitive data pattern; and

assigning the first sensitivity score based on the searching of the sensitive data pattern.

18. The computer system of claim 16 , wherein the searching for the sensitive data pattern includes applying at least one of a regular expression, a wildcard search, and a machine learning model.

19. The computer system of claim 16 , wherein assigning the sensitivity score further comprises:

identifying a first sensitive data pattern in the stored procedure;

identifying a second sensitive data pattern in the stored procedure, the second sensitive data pattern being associated with a higher sensitivity score than the first sensitive data pattern; and

assigning the sensitivity score based on the second sensitive data pattern.

20. The computer system of claim 16 , wherein comparing the first sensitivity score and the second sensitivity score further comprises:

computing a difference between the first sensitivity score and the second sensitivity score; and

identifying a potential malicious activity responsive to a determination that the difference exceeds a predetermined threshold.

Assignments (1)

Continuity (1)

References Cited (13)