A Database Operation Source Identify Algorithm for Multi-Layer Information Architecture

In a database protection system based on user behavior analysis, the capability of operation source identification is very important for illegal transaction detection and alert. But in a multilayer information architecture, the database operation trails are cut off by middle layer service systems, which makes the operation source can be identified only by embedded audit modules. Since it is too expensive for many application systems to rebuild and embed such modules, the paper proposes an economical solution which can identify the database operation source close to the fact. The advantage of the algorithm is its support to bypass monitoring mode, which needs no change to existed application systems and is more economical than embedded audit modules. The paper discusses the main components of the algorithm: (1) the automatic learning process, (2) the real time identification process.