Abstract:A considerable effort has been recently devoted to the development of Database Management Systems (DBMS) which guarantee high assurance and security. An important component of any strong security solution is represented by Intrusion Detection (ID) techniques, able to detect anomalous behavior of applications and users. To date, however, there have been few ID mechanisms proposed which are specifically tailored to function within the DBMS. In this paper, we propose such a mechanism. Our approach is based on mining SQL queries stored in database audit log files. The result of the mining process is used to form profiles that can model normal database access behavior and identify intruders. We consider two different scenarios while addressing the problem. In the first case, we assume that the database has a Role Based Access Control (RBAC) model in place. Under a RBAC system permissions are associated with roles, grouping several users, rather than with single users. Our ID system is able to determine role intruders, that is, individuals while holding a specific role, behave differently than expected. An important advantage of providing an ID technique specifically tailored to RBAC databases is that it can help in protecting against insider threats. Furthermore, the existence of roles makes our approach usable even for databases with large user population. In the second scenario, we assume that there are no roles associated with users of the database. In this case, we look directly at the behavior of the users. We employ clustering algorithms to form concise profiles representing normal user behavior. For detection, we either use these clustered profiles as the roles or employ outlier detection techniques to identify behavior that deviates from the profiles. Our preliminary experimental evaluation on both real and synthetic database traces shows that our methods work well in practical situations.

CNN-LSTM Neural Networks for Anomalous Database Intrusion Detection in RBAC-Administered Model

Attention Based CNN-LSTM Network for Anomaly Pattern Classification of Multivariate Time Series

Using a Long Short-Term Memory Recurrent Neural Network (LSTM-RNN) to Classify Network Attacks

CNN features with bi-directional LSTM for real-time anomaly detection in surveillance networks

Detecting the Insider Threat with Long Short Term Memory (LSTM) Neural Networks

An efficient network behavior anomaly detection using a hybrid DBN-LSTM network

A CNN-RNN Combined Structure for Real-World Violence Detection in Surveillance Cameras

Hunting for Insider Threats Using LSTM-based Anomaly Detection

Anomaly-Based Web Attack Detection

Network Intrusion Detection Method Based on CNN-BiLSTM-Attention Model

Anomaly-Based Web Attack Detection: A Deep Learning Approach

Efficient Deep CNN-BiLSTM Model for Network Intrusion Detection

Detecting anomalous access patterns in relational databases

Using a Recurrent Neural Network and Restricted Boltzmann Machines for Malicious Traffic Detection

Detecting Web Attacks From HTTP Weblogs Using Variational LSTM Autoencoder Deviation Network

Research on Web Intrusion Technology Based on DBN

Sensitive Data Detection with High-Throughput Neural Network Models for Financial Institutions

CausalConvLSTM: Semi-Supervised Log Anomaly Detection Through Sequence Modeling

Administrative Management Data Anomaly Access Detection Method, Based on 6G IoT

Network Anomaly Intrusion Detection Based on Deep Learning Approach