US 12,223,075 B2
Autonomous machine learning methods for detecting and thwarting malicious database access
Purandar Gururaj Das, Lexington, MA (US); and Shanthi Boppana, Boxborough, MA (US)
Assigned to Sotero, Inc., Burlington, MA (US)
Filed by Sotero, Inc., Burlington, MA (US)
Filed on Oct. 13, 2022, as Appl. No. 17/965,387.
Application 17/965,387 is a continuation of application No. 17/860,196, filed on Jul. 8, 2022, granted, now 11,501,013.
Claims priority of provisional application 63/219,933, filed on Jul. 9, 2021.
Prior Publication US 2023/0033716 A1, Feb. 2, 2023
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 29/06 (2006.01); G06F 21/56 (2013.01); G06F 21/62 (2013.01); G06N 20/00 (2019.01)
CPC G06F 21/6218 (2013.01) [G06F 21/566 (2013.01); G06N 20/00 (2019.01); G06F 2221/034 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A method for detecting malicious database access, the method comprising:
receiving, at a processor, a request including a query and referencing a database;
identifying, via the processor, at least one request attribute from a plurality of request attributes associated with the request, the plurality of request attributes including a representation of at least one of: a user from which the request originated, a time of submission of the request, a location from which the request was transmitted, an internet protocol (IP) address associated with the request, or a dataset referenced by the request;
identifying a query result based on the request and during a first time period;
analyzing the at least one request attribute during the first time period, using a self-learning machine learning algorithm, to identify an anomaly score for anomaly detection;
in response to the anomaly score exceeding a first threshold from a plurality of predefined thresholds, sending, via the processor and during a second time period, a signal representing a quarantine request;
in response to the anomaly score being between the first threshold and a second threshold from the plurality of predefined thresholds, sending, via the processor and during a second time period, a signal representing a notification, and sending a signal representing the query result; and
in response to the anomaly score being below the second threshold from the plurality of predefined thresholds, sending a signal representing a notification that the request is allowed without sending a signal representing content from the database referenced by the query.