Patent ID: 11916941
Assignee: IMPERVA, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 0:
1. A method by a database agent implemented by one or more electronic devices that monitors database connections established between one or more database clients and one or more databases, wherein the database agent is communicatively coupled to a security analysis server, the method comprising:
sending, to the security analysis server because of a current configuration of the database agent, a count of an amount of traffic, rather than all traffic, sent over each database connection in a first set of one or more of the database connections being monitored by the database agent;
sending, to the security analysis server, samples of traffic sent over database connections in the first set of one or more database connections, wherein the security analysis server sends the samples of traffic to a database connection type classifier that is to classify the database connections in the first set of one or more database connections as being of an application database connection type or a non-application database connection type based on the samples of traffic, wherein the application database connection type is a type of database connection over which application-generated queries are submitted and the non-application database connection type is a type of database connection over which ad-hoc queries are submitted;
receiving, from the security analysis server, an instruction to send to the security analysis server a count of an amount of traffic, rather than all the traffic, sent over each database connection in a second set of one or more of the database connections being monitored by the database agent that have been determined by the security analysis server to be of the application database connection type and to send to the security analysis server traffic sent over other database connections; and
responsive to receiving the instruction, sending, to the security analysis server, the count of the amount of traffic, rather than all the traffic, sent over each database connection in the second set of one or more database connections and sending to the security analysis server traffic sent over the other database connections.