Computer code intrusion detection system based on acceptable retrievals

• US 7,406,714 B1
• Filed: 07/31/2003
• Issued: 07/29/2008
• Est. Priority Date: 07/01/2003
• Status: Expired due to Fees

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Nachenberg, Carey
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): POLTORAK, PIOTR
• Application Number:
  US10/632,857
• Time in Patent Office: 1,825 Days
• Field of Search: 726 22- 25
• US Class Current: 726/23
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database

Abstract

Methods, apparati, and computer-readable media for protecting computer code (1) from malicious retrievers (3). A method embodiment of the present invention comprises the steps of generating (22) retrieval information characteristic of data sent to a retriever (3) by the computer code (1) in response to a retrieval command (5) issued by the retriever (3); accessing at least one rule (6) using at least some of said retrieval information as an input to said at least one rule (6); and, when said at least one rule (6) informs that the retrieval is not acceptable, flagging (28) the retrieval command (5) as suspicious.

Claims

1. A computer-implemented method for protecting computer code from malicious retrievers, the method comprising the steps of:

observing a plurality of retrieval commands that access the computer code;

observing responses to the plurality of retrieval commands generated by the computer code;

deriving from the plurality of retrieval commands and the responses a set of retrieval information, the set of retrieval information comprising input vectors characterizing the plurality of retrieval commands;

converting the set of retrieval information into at least one rule for determining whether retrieval commands are acceptable;

generating retrieval information characteristic of data sent to a retriever by the computer code in response to a retrieval command issued by the retriever, the retrieval information comprising an input vector characterizing the retrieval command;

determining whether the retrieval command is acceptable using at least some of the retrieval information as an input to the at least one rule; and

responsive to the retrieval command being not acceptable, performing at least one of the following;

restricting the retrieval command from accessing the computer code,

allowing the retrieval command limited access to the computer code,

augmenting the command, and

investigating a sender of the command.

2. The method of claim 1 wherein the retrieval information comprises a retrieval vector.

3. The method of claim 2 wherein the retrieval vector comprises at least one of the following:

number of rows in the retrieval;

number of columns in the retrieval;

number of tables in the retrieval;

identification of columns in the retrieval;

identification of tables in the retrieval.

4. The method of claim 1 wherein the retrieval information comprises statistical information.

5. The method of claim 4 wherein at least some of the statistical information is contained in a state table.

6. The method of claim 4 wherein a plurality of retrieval commands are issued, and the statistical information comprises at least one of the following:

rate of retrieving rows from the computer code;

rate of retrieving columns from the computer code;

rate of retrieving tables from the computer code;

average number of rows retrieved per retrieval command for a given input vector, where an input vector contains parameterized information characteristic of the retrieval command;

average number of columns retrieved per retrieval command for a given input vector;

average number of tables retrieved per retrieval command for a given input vector;

percentage of retrieval commands for which a given column is accessed;

percentage of retrieval commands for which a given table is accessed;

percentage of retrieval commands for which a given combination of columns is accessed;

percentage of retrieval commands for which a given combination of tables is accessed.

7. The method of claim 1 wherein the at least one rule is also accessed by an input vector containing parameterized information characteristic of the retrieval command.

8. The method of claim 7 wherein the input vector is extracted from a retrieval command by at least one technique from the group of techniques comprising real-time auditing and in-line interception.

9. The method of claim 7 wherein the at least one rule is accessed by at least two input vectors, each input vector being associated with the same retrieval command.

10. The method of claim 7 wherein the input vector comprises at least one parameter from the group of parameters comprising:

canonicalized commands;

dates and times at which commands access the computer code;

logins of users that issue commands;

identities of users that issue commands;

departments of users that issue commands;

applications that issue commands;

IP addresses of issuing users;

identities of users accessing a given field within the computer code;

times of day that a given user accesses a given field within the computer code;

fields accessed by commands;

combinations of fields accessed by commands;

tables within the computer code accessed by commands;

combinations of tables within the computer code accessed by commands.

11. The method of claim 10 wherein a canonicalized command is a retrieval command stripped of literal field data.

12. The method of claim 1, further comprising sending a message to a user or a computer, and updating a log.

13. The method of claim 1 wherein the computer code is a database.

14. The method of claim 13 wherein the retrieval command is a SQL command.

15. The method of claim 1 wherein deriving from the plurality of retrieval commands and the responses a set of retrieval information further comprises deriving from the plurality of retrieval commands and the responses a set of retrieval information based on a set of preselected set of parameters.

16. The method of claim 15 wherein the at least one rule comprises at least one rule derived from statistical information of the set of retrieval information.

17. The method of claim 15 wherein deriving from the plurality of retrieval commands and the responses the set of retrieval information and converting the set of retrieval information into the at least one rule for determining whether the retrieval commands are acceptable are performed in real time.

18. The method of claim 1 wherein the input vectors are extracted from the plurality of retrieval commands by at least one technique from the group of techniques comprising real-time auditing and in-line interception.

19. The method of claim 1 wherein observing the plurality of retrieval commands comprises at least one of:

real-time auditing; and

in-line interception.

20. The method of claim 1 wherein the step of observing the plurality of retrieval commands comprises real-time auditing;

and at least one of the following is used to extract the plurality of retrieval commands for observation;

an API that accesses the computer code;

code injection;

patching;

direct database integration;

log file examination.

21. The method of claim 1 wherein the step of observing the plurality of retrieval commands comprises in-line interception;

and at least one of the following is interposed between senders of the plurality of retrieval commands and the computer code;

a proxy;

a firewall;

a sniffer.

22. The method of claim 1 wherein the step of observing responses to the plurality of retrieval commands comprises at least one of:

real-time auditing; and

in-line interception.

23. The method of claim 1 wherein the step of observing responses to the plurality of retrieval commands comprises real-time auditing;

and at least one of the following is used to extract the plurality of retrieval commands for observation;

an API that accesses the computer code;

code injection;

patching;

direct database integration;

log file examination.

24. The method of claim 1 wherein the step of observing responses to the plurality of retrieval commands comprises in-line interception;

and at least one of the following is interposed between senders of the plurality of retrieval commands and the computer code;

a proxy;

a firewall;

a sniffer.

25. The method of claim 1 wherein a duration of performing deriving from the plurality of retrieval commands and the responses the set of retrieval information and converting the set of retrieval information into the at least one rule for determining whether the retrieval commands are acceptable is determined by statistical means.

26. The method of claim 25 wherein:

during the duration, suspicious activity is tracked; and

the suspicious activity is subsequently reported to a system administrator.

27. The method of claim 1 wherein the generating step comprises at least one of:

real-time auditing; and

in-line interception.

28. The method of claim 1 wherein the at least one rule comprises at least one rule provided by a system administrator.

29. The method of claim 1 wherein the at least one rule comprises at least one rule provided by a vendor.

30. The method of claim 1 wherein the at least one rule comprises a pre-established rule table pertaining to retrievals.

31. A computer-readable medium containing computer program instructions for protecting computer code from malicious retrievers, the computer program instructions performing the steps of:

observing a plurality of retrieval commands that access the computer code;

observing responses to the plurality of retrieval commands generated by the computer code;

deriving from the plurality of retrieval commands and the responses a set of retrieval information, the set of retrieval information comprising input vectors characterizing the plurality of retrieval commands;

converting the set of retrieval information into at least one rule for determining whether retrieval commands are acceptable;

generating retrieval information characteristic of data sent to a retriever by the computer code in response to a retrieval command issued by the retriever, the retrieval information comprising an input vector characterizing the retrieval command;

determining whether the retrieval command is acceptable using at least some of the retrieval information as an input to the at least one rule; and

responsive to the retrieval command being not acceptable, performing at least one of the following;

restricting the retrieval command from accessing the computer code,

allowing the retrieval command limited access to the computer code,

augmenting the command, and

investigating a sender of the command.

32. Apparatus for protecting computer code from malicious retrievers, the apparatus comprising:

a computer processor;

a training module configured to be executed by the computer processor for observing a plurality of retrieval commands that access the computer code, observing responses to the plurality of retrieval commands generated by the computer code, and deriving from the plurality of retrieval commands and the responses a set of retrieval information, the set of retrieval information comprising input vectors characterizing the plurality of retrieval commands;

a computation module configured for converting the set of retrieval information into at least one rule for determining whether retrieval commands are acceptable, the at least one rule associated with a input vector, generating retrieval information characteristic of data sent to a retriever by the computer code in response to a retrieval command issued by the retriever, the retrieval information comprising an input vector characterizing the retrieval command, and responsive to the input vector of the retrieval information matching the input vector associated with the at least one rule, determining whether the retrieval command is acceptable using at least some of the retrieval information as an input to the at least one rule; and

a post flagging module communicatively connected with the training module and the computation module, the post flagging module configured for responsive to the retrieval command being not acceptable by performing at least one of the following;

restricting the retrieval command from accessing the computer code,

allowing the retrieval command limited access to the computer code,

augmenting the command, and

investigating a sender of the command.