Device, system and method of database security

• US 20070204342A1
• Filed: 02/27/2007
• Published: 08/30/2007
• Est. Priority Date: 02/27/2006
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: Sentrigo, LLC (McAfee, LLC)
• Inventors: Shuchami, Nathan, Markovich, Slavik
• Granted Patent: US 8,069,482 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: G06F 16/217 Database tuning G06F16/2282 takes precedence; database performance monitoring G06F11/3409
• CPC Class Codes: G06F 16/24565 Triggers; Constraints
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries

Abstract

Some demonstrative embodiments of the invention relate to a method, device and system of database security. One demonstrative embodiment of the invention includes an intrusion detection sensor to scan transactions on a database, and generate an event based on a detection profile. Other embodiments are described and claimed.

Claims

1. An intrusion detection sensor to scan transactions on a database and generate an event based on a detection profile, wherein an intrusion-detection-efficiency (IDE) of said sensor is at least six when a rate of said transactions is at least ten transactions per second.

2. The intrusion detection sensor of claim 1, wherein said IDE comprises a ratio between an intrusion-detection-success-rate (IDSR) of said sensor and a processor utilization by said sensor.

3. The intrusion detection sensor of claim 2, wherein said IDSR relates to a test profile defining an event is to be generated in response to each of a plurality of select operations performed on said database, said IDSR comprises a ratio between a number of events generated by said sensor when said detection profile comprises said test profile and a number of said plurality of select operations.

4. The intrusion detection sensor of claim 2, wherein the IDSR of said sensor is at least ninety percent.

5. The intrusion detection sensor of claim 4, wherein the IDSR of said sensor is at least ninety five percent.

6. The intrusion detection sensor of claim 5, wherein the IDSR of said sensor is substantially one hundred percent.

7. The intrusion detection sensor of claim 2, wherein said processor utilization is fifteen percent or less.

8. The intrusion detection sensor of claim 7, wherein said processor utilization is ten percent or less.

9. The intrusion detection sensor of claim 8, wherein said processor utilization is five percent or less.

10. The intrusion detection sensor of claim 1, wherein the IDE of said sensor is at least eight.

11. The intrusion detection sensor of claim 10, wherein the IDE of said sensor is at least ten.

12. The intrusion detection sensor of claim 1, wherein the rate of said transactions is at least fifty transactions per second.

13. The intrusion detection sensor of claim 12, wherein the rate of said transactions is at least one hundred transactions per second.

14. The intrusion detection sensor of claim 13, wherein the rate of said transactions is at least five hundred transactions per second.

15. The intrusion detection sensor of claim 1, wherein said detection profile includes one or more predefined detection rules relating to said transactions.

16. The intrusion detection sensor of claim 1, wherein said sensor is able to access said database via a direct memory attachment.

17. A database system comprising:

a database;

an intrusion detection sensor able to access said database; and

a server to provide said intrusion detection sensor with a detection profile,

wherein said sensor is able to scan transactions over said database, and generate an event based on said detection profile, and

wherein an intrusion-detection-efficiency (IDE) of said sensor is at least six when a rate of said transactions is at least ten transactions per second.

18. The database system of claim 17, wherein said IDE comprises a ratio between an intrusion-detection-success-rate (IDSR) of said sensor and a processor utilization by said sensor.

19. The database system of claim 18, wherein said IDSR relates to a test profile defining an event is to be generated in response to each of a plurality of select operations performed on said database, said IDSR comprises a ratio between a number of events generated by said sensor when said detection profile comprises said test profile and a number of said plurality of select operations.

20. The database system of claim 18, wherein the IDSR of said sensor is at least ninety percent.

21. The database system of claim 18, wherein said processor utilization is fifteen percent or less.

22. The database system of claim 17, wherein the IDE of said sensor is at least eight.

23. The database system of claim 17, wherein the rate of said transactions is at least fifty transactions per second.

24. A method comprising:

detecting intrusions to a database at an intrusion-detection-efficiency (IDE) of at least six when a rate of transactions on said database is at least ten transactions per second,

wherein said detecting comprises scanning said transactions, and generating an event based on a detection profile.

25. The method of claim 24, wherein said IDE comprises a ratio between an intrusion-detection-success-rate (IDSR) of said sensor and a processor utilization by said sensor.

26. The method of claim 25, wherein said IDSR relates to a test profile defining an event is to be generated in response to each of a plurality of select operations performed on said database, said IDSR comprises a ratio between a number of events generated by said sensor when said detection profile comprises said test profile and a number of said plurality of select operations.

27. The method of claim 25, wherein the IDSR of said sensor is at least ninety percent.

28. The method of claim 25, wherein said processor utilization is fifteen percent or less.

29. The method of claim 24, wherein the IDE of said sensor is at least eight.

30. The method of claim 24, wherein the rate of said transactions is at least fifty transactions per second.

31. A machine-readable medium having stored thereon instructions, which when executed by a machine result in:

an intrusion detection sensor to scan transactions on a database and generate an event based oil a detection profile, wherein said instructions result in said sensor having an intrusion-detection-efficiency (IDE) of at least six when a rate of said transactions is at least ten transactions per second.

32. The machine-readable medium of claim 31, wherein said IDE comprises a ratio between an intrusion-detection-success-rate (IDSR) of said sensor and a processor utilization by said sensor.

33. The machine-readable medium of claim 32, wherein said IDSR relates to a test profile defining an event is to be generated in response to each of a plurality of select operations performed on said database, said IDSR comprises a ratio between a number of events generated by said sensor when said detection profile comprises said test profile and a number of said plurality of select operations.

34. The machine-readable medium of claim 32, wherein said instructions result in said sensor having the IDSR of at least ninety percent.

35. The machine-readable medium of claim 31, wherein said instructions result said sensor having said IDE when the rate of said transactions is at least fifty transactions per second.