Identifying an application user as a source of database activity

• US 20080275843A1
• Filed: 03/30/2007
• Published: 11/06/2008
• Est. Priority Date: 03/30/2007
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Lal, Amrish K., Chandran, Vivek M., Hu, Ron-Chung, Desai, Ravil A.
• Granted Patent: US 7,917,759 B2
• Time in Patent Office: Days
• US Class Current: 707/3
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

Determining an application user as a source of database activity is disclosed. A communication is received. A thread that is configured to handle the communication is associated with an application user with which the communication is associated. The application user is associated with a database query generated by the thread.

Claims

1. A method of determining an application user as a source of database activity comprising:

receiving a communication;

associating a thread configured to handle the communication with an application user with which the communication is associated; and

associating the application user with a database query generated by the thread.

2. The method of claim 1 further including providing an indication to a downstream reader that the query is associated with the application user.

3. The method of claim 2 wherein the downstream reader is a database security monitor.

4. The method of claim 2 wherein providing an indication includes inserting a comment into the query.

5. The method of claim 2 wherein providing an indication includes sending an email to the downstream reader.

6. The method of claim 2 wherein providing an indication includes generating a dummy query.

7. The method of claim 6 wherein the dummy query includes an indication that subsequent queries are associated with the application user.

8. The method of claim 2 wherein providing an indication includes writing to a log file.

9. The method of claim 1 wherein the communication is a request.

10. The method of claim 1 wherein the communication is a request requiring an interaction with a database.

11. The method of claim 1 wherein associating a thread configured to handle the communication with an application user includes using a thread local variable.

12. The method of claim 1 wherein the communication is one of a plurality of communications associated with a transaction.

13. The method of claim 1 wherein associating a thread configured to handle the communication with an application user includes associating the thread with at least one piece of extracted information.

14. A system for determining an application user as a source of database activity, including:

a processor; and

a memory coupled with the processor, wherein the memory is configured to provide the processor with instructions which when executed cause the processor to;

receive a communication;

associate a thread configured to handle the communication with an application user with which the communication is associated; and

associate the application user with a database query generated by the thread.

15. The system of claim 14 wherein the memory is further configured to provide the processor with instructions which when executed cause the processor to provide an indication to a downstream reader that the query is associated with the application user.

16. The system of claim 15 wherein the downstream reader is a database security monitor.

17. The system of claim 15 wherein providing an indication includes generating a dummy query.

18. A computer program product for determining an application user as a source of database activity, the computer program product being embodied in a computer readable medium and comprising computer instructions for:

receiving a communication;

associating a thread configured to handle the communication with an application user with which the communication is associated; and

associating the application user with a database query generated by the thread.

19. A computer program product as recited in claim 18, the computer program product further comprising computer instructions for providing an indication to a downstream reader that the query is associated with the application user.

20. A computer program product as recited in claim 19 wherein the downstream reader is a database security monitor.