DYNAMICALLY DIFFERENTIATING SERVICE IN A DATABASE BASED ON A SECURITY PROFILE OF A USER

摘要

One embodiment of the present invention provides a system that differentiates service provided to a database user based on a security profile of the user. During operation, the system receives a sequence of commands from a user at a database system. The system then uses the sequence of commands to determine a security profile which indicates whether the user is behaving suspiciously. Next the system associates a resource consumer group with the user based on the security profile. Finally, the system differentiates service provided to the user based on the resource consumer group.

主权项

1. A method for differentiating service based on a security profile of a user, the method comprising:
receiving a sequence of database commands from a user at a database server in the database system; determining command information from the database commands, wherein the extracted command information includes at least a table or a column accessed by the database commands; applying pre-specified rules to the command information to determine a security profile, which involves determining whether the access to the table or column matches criteria for suspicious behavior, wherein the security profile indicates a level of suspicious activity for the user; based on at least the level of suspicious activity for the user, differentiating services provided to the user's session by performing at least one of:
decreasing the amount of processor time that the user is allowed to utilize to be below a percentage of processor time determined by the security profile; andmigrating the user's session to a database instance for suspicious sessions.