Method and apparatus for monitoring a database system

• US 20040024736A1
• Filed: 02/24/2003
• Published: 02/05/2004
• Est. Priority Date: 02/22/2002
• Status: Active Grant

• Current Assignee: IPLocks, Inc. (Fortinet Inc.)
• Original Assignee: IPLocks, Inc. (Fortinet Inc.)
• Inventors: Sudia, Frank, Sakamoto, Akio, Mukherjee, Amarnath, Raj, Seshan S.
• Granted Patent: US 7,085,780 B2
• Time in Patent Office: Days
• US Class Current: 707/1
• CPC Class Codes: G06F 16/2365 Ensuring data consistency and integrity
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: Y10S 707/99931 Database or file accessing
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

Techniques are provided for monitoring a database system. A set of data elements may be read from a database system into a device. The device may be external to the database system. From the device, a set of analysis operations are performed on the data elements in order to identify if any of the date elements satisfy a criteria for being considered potentially anomalous. A notification is signaled if potentially anomalous data is identified.

Claims

1. A method for monitoring a database system, wherein the database system is operated using a set of one or more processors, the steps comprising:

reading data elements managed by the database system, wherein the data elements include data stored as content within a database of the database system;

performing a set of analysis operations on the data elements in order to identify one or more data elements that are anomalous based on criteria defined by the set of analysis operations; and

automatically signaling a notification after identifying the one or more data elements are potentially anomalous;

wherein steps comprising the method are substantially performed using processing resources that are external to the set of one or more processors.

2. The method of claim 1, wherein the steps of the method are performed without executing any agents on the database system.

3. The method of claim 1, wherein the step of performing a set of analysis operations on the data elements are performed without executing any code on the set of one or more processors.

4. The method of claim 1, wherein reading data elements managed by the database system include reading metadata about a schema of the database.

5. The method of claim 1, wherein reading data elements managed by the database system include reading data representing a set of privileges for enabling one or more users of the database system to do at least one of view, change or delete data within the database.

6. The method of claim 1, wherein the step of automatically signaling a notification includes sending an email to at least a first designated email address.

7. The method of claim 1, wherein the step of automatically signaling a notification includes paging at least a first designated phone number.

8. The method of claim 1, performing a set of analysis operations includes comparing at least some of the data elements to data elements read at an earlier instance of time.

9. The method of claim 4, wherein reading data elements includes reading a system catalog of the database, and wherein performing a set of analysis operations on the data elements in order to identify one or more data elements includes comparing the system catalog to a system catalog that was read from the database at an earlier instance.

10. A method for monitoring a database system, the method comprising:

identifying a set of data elements stored as content within a database of the database system; and

performing a series of analysis processes on the set of data elements in order to identify data within the database that is potentially anomalous.

11. The method of claim 10, wherein identifying a set of data includes reading the set of data from the database system.

12. The method of claim 11, further comprising reading the set of data from the database system from an external machine.

13. The method of claim 10, wherein performing a series of analysis processes includes performing a first process on the data elements for making a first determination as to whether any data in the database is anomalous based on a first characteristic of the set of data elements, and a second process on the data elements for making a second determination as to whether any data in the database is anomalous based on a second characteristic of the set of data elements.

14. The method of claim 13, wherein performing a series of analysis processes includes performing a third process on the data elements for making a third determination as to whether any data in the database is anomalous based on a third characteristic of the set of data elements.

15. The method of claim 10, wherein performing a series of analysis processes includes comparing the set of data elements to a set of parameters defined by a user.

16. The method of claim 13, wherein performing a series of analysis processes includes determining a maximum value of two or more data element in the set of data elements, a minimum value of two or more data element in the set of data elements, and an average value of two or more data elements in the set of data elements.

17. The method of claim 16, wherein performing a series of analysis processes includes comparing at least one of the maximum value, the minimum value, and the average value to values determined from a previous time period.

18. The method of claim 13, wherein performing a series of analysis processes includes selecting a group of data from the set of data elements, and determining a characteristic of the group of data.

19. The method of claim 18, wherein determining a characteristic of the group of data includes determining one or more of a maximum value data element in the group of data, a minimum value data element in the group of data, and an average value of the group of data.

20. The method of claim 18, wherein selecting a group of data includes selecting the group of data based on one or more user-defined parameters.

21. The method of claim 10, wherein performing a series of analysis processes includes clustering values identified from the set of data elements using a statistical distribution, and then identifying data within the database that is potentially anomalous using the statistical distribution.

22. The method of claim 21, wherein performing a series of analysis processes includes identifying data points of values for individual data elements based on ranges of two or more parameters that define the individual data element within the database.

23. The method of claim 22, wherein the two or more parameters correspond to a first parameter identifying a row of the individual data element, and a second parameter identifying a column of the individual data element.

24. The method of claim 10, wherein performing a series of analysis processes includes comparing a result of one or more of the series of analysis processes to a previous result from performing the one or more series of analysis processes on a set of data elements identified from the database at a previous time period.

25. The method of claim 10, wherein performing a series of analysis processes includes comparing a result of one or more of the series of analysis processes to a designated set of results.

26. The method of claim 10, further comprising automatically signaling a notification if potentially anomalous data is identified.

27. The method of claim 26, wherein signaling a notification includes sending an email to a designated email address.

28. The method of claim 26, wherein signaling a notification includes paging a designated phone number.

29. The method of claim 10, further comprising compiling a result of performing the series of analysis processes at one or more instances into a report.

30. The method of claim 29, further comprising compiling the potentially anomalous data into the report.

31. The method of claim 10, further comprising associating potentially anomalous data with an event that caused the data to be stored in the database.

32. The method of claim 31, further comprising archiving a plurality of events that cause anomalous data to be stored in the database.

33. A method for monitoring a database system, the method comprising:

identifying, at one or more instances in a designated time period, a set of data elements stored as content within a database of the database system;

identifying trend data for how the set of data elements are modified over the designated time period; and

performing, based on the trend data, one or more analysis operations in order to identify potentially anomalous data within the database.

34. The method of claim 33, wherein the step of performing one or more analysis operations includes adjusting the one or more analysis operations based on the trend data.

35. The method of claim 33, wherein the step of performing one or more analysis operations includes selecting the one or more analysis operations based on the trend data.

36. The method of claim 33, wherein identifying a trend for how the set of data elements are modified includes identifying the trend data over a duration designated by a user.

37. The method of claim 33, further comprising, once the designated time period is over, repeating the step of identifying a set of data elements, and then performing the one or more analysis operations based on the trend data identified during the designated time period.

38. The method of claim 33, wherein identifying a set of data elements includes reading the set of data elements from a database of the database system.

39. The method of claim 33, wherein the step of identifying a set of data elements is repeated at multiple instances over the designated time period, and wherein the step of identifying trend data for how the set of data elements are modified includes updating the trend data after each instance of identifying the set of data elements.

40. The method of claim 33, further comprising automatically signaling a notification if potentially anomalous data is identified.

41. The method of claim 40, wherein signaling a notification includes sending an email to a designated email address.

42. The method of claim 40, wherein signaling a notification includes paging a designated phone number.

43. The method of claim 33, further comprising compiling a result of performing the one or more analysis operations into a report.

44. The method of claim 33, further comprising compiling the potentially anomalous data into the report.

45. The method of claim 33, further comprising associating potentially anomalous data with an event that caused the data to be stored in the database.

46. The method of claim 45, further comprising archiving a plurality of events that cause anomalous data to be stored in the database.