Real-Time Outlier Connections Detection in Databases Network Traffic

TL;DR

This paper presents a real-time, non-intrusive method for detecting outlier database connections using generalized security rules and machine learning, applicable across various database types to enhance proactive security.

Contribution

It introduces a novel real-time outlier detection approach that is non-intrusive, database-agnostic, and capable of proactive access control with minimized false positives.

Findings

Effective detection of outlier connections demonstrated in real-world scenarios

Proactive control of database access before connection establishment

Maintains high response speed with low false positive rate

Abstract

The article describes a practical method for detecting outlier database connections in real-time. Outlier connections are detected with a specified level of confidence. The method is based on generalized security rules and a simple but effective real-time machine learning mechanism. The described method is non-intrusive to the database and does not depend on the type of database. The method is used to proactively control access even before database connection is established, minimize false positives, and maintain the required response speed to detected database connection outliers. The capabilities of the system are demonstrated with several examples of outliers in real-world scenarios.