Abstract:A considerable effort has been recently devoted to the development of Database Management Systems (DBMS) which guarantee high assurance and security. An important component of any strong security solution is represented by Intrusion Detection (ID) techniques, able to detect anomalous behavior of applications and users. To date, however, there have been few ID mechanisms proposed which are specifically tailored to function within the DBMS. In this paper, we propose such a mechanism. Our approach is based on mining SQL queries stored in database audit log files. The result of the mining process is used to form profiles that can model normal database access behavior and identify intruders. We consider two different scenarios while addressing the problem. In the first case, we assume that the database has a Role Based Access Control (RBAC) model in place. Under a RBAC system permissions are associated with roles, grouping several users, rather than with single users. Our ID system is able to determine role intruders, that is, individuals while holding a specific role, behave differently than expected. An important advantage of providing an ID technique specifically tailored to RBAC databases is that it can help in protecting against insider threats. Furthermore, the existence of roles makes our approach usable even for databases with large user population. In the second scenario, we assume that there are no roles associated with users of the database. In this case, we look directly at the behavior of the users. We employ clustering algorithms to form concise profiles representing normal user behavior. For detection, we either use these clustered profiles as the roles or employ outlier detection techniques to identify behavior that deviates from the profiles. Our preliminary experimental evaluation on both real and synthetic database traces shows that our methods work well in practical situations.

A Novel Control-flow based Intrusion Detection Technique for Big Data Systems

Call Trace and Memory Access Pattern based Runtime Insider Threat Detection for Big Data Platforms

Dynamical System Theory for the Detection of Anomalous Behavior in Computer Programs

An Artificial Intelligence-based, Big Data-aware, Long-lasting Security Solution for the Internet of Things

A Novel Lightweight NIDS Framework for Detecting Anomalous Data Traffic in Contemporary Networks

An Ensemble-Based Scalable Approach for Intrusion Detection Using Big Data Framework

Intrusion detection based on graph-directed analytics of the big data

A distributed platform for intrusion detection system using data stream mining in a big data environment

Indra: A Distributed Approach to Network Intrusion Detection and Prevention

Detection of Multiplicative False Data Injection Cyberattacks on Process Control Systems via Randomized Control Mode Switching

Program Intrusion Detection Based on Simplified Control Flow Monitoring

Big data analysis and distributed deep learning for next-generation intrusion detection system optimization

SEINA: A Stealthy and Effective Internal Attack in Hadoop Systems

Research on Principle Techniques for Network Intrusion Detection Based on Data Mining and Analysis Approach

An integrated pattern recognition approach for intrusion detection

A Novel Intrusion Detection Method Based on Principle Component Analysis in Computer Security

Detecting Anomalies in Distributed Control Systems by Modeling Traffic Behaviors

Detecting anomalous access patterns in relational databases

Identifying Non-Control Security-Critical Data through Program Dependence Learning

Advanced Network Security Analysis (ANSA) in Big Data Technology

A computationally efficient dimensionality reduction and attack classification approach for network intrusion detection