DBSAFE—An Anomaly Detection System to Protect Databases From Exfiltration Attempts

Sallam, Asmaa; Bertino, Elisa; Hussain, Syed Rafiul; Landers, David; Lefler, R. M.; Steiner, Donald

doi:10.1109/jsyst.2015.2487221

Cited by 29 publications

(14 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The system's architecture consists of five main components: target DBMS (T‐DBMS), AD engine (ADE), query interceptor (QI), mediator, and the response engine. The T‐DBMS is a conventional DBMS that manages the monitored database and handles the query evaluation process.…”

Section: Methodology and System Architecturementioning

confidence: 99%

“…The selectivity of a table is null if the table is not referenced in the query. Methods to estimate the selectivities of tables in an SQL query are described in Ref . An example database and the quadruplet representation of example queries on it are shown in Figure .…”

Section: Query Representationmentioning

confidence: 99%

“…Even though the methods proposed are computationally fast as they only need to parse the query in order to perform AD, some attributes of the query cannot be captured by relying upon the query syntax only, such as the size of the query result set and the characteristics of the portions of accessed tables that will show in the result. The approach presented in this paper is a major extension of our previous work to take into consideration the common access patterns between roles.…”

Section: Related Workmentioning

confidence: 99%

“…Such technique creates profiles of users’ data access patterns and then uses these profiles to detect anomalies in new accesses. Approaches for AD for database systems can be categorized into: (1) syntax‐based approaches by which the access profiles consist of features extracted from the query syntax and (2) data‐based approaches by which the profiles are created based on the actual data (or sample of data) returned by the queries. These approaches have drawbacks, including being specific to only one DBMS (e.g., PostgreSQL), having overhead at run time for inspecting the returned data, or being unable to deal with applications that retrieve data according to a retrieval loop consisting of several fetch operations.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Data and syntax centric anomaly detection for relational databases

Sallam

Fadolalkarim

Bertino

et al. 2016

WIREs Data Min & Knowl

Self Cite

View full text Add to dashboard Cite

Recent studies show that insider attacks that aim at exfiltrating data are very common and that these attacks are performed according to specific patterns. Protecting against such threats requires complementing existing security techniques, such as access control and encryption, with tools able to detect anomalies in data accesses. In this paper, we present a technique specifically tailored for detecting anomalous database accesses. Our technique extracts users’ access patterns based on both the syntax of the input queries and the amount of data in their output results. Our technique is based on mining SQL queries in database audit logs in order to form profiles of the normal users’ access patterns. New queries are checked upon these profiles, and deviations from these profiles are considered anomalous and thus indicative of possible attempts to exfiltrate or misuse the data. Our technique works under two application scenarios. The first is when the database has role‐based access control (RBAC) in place. Under an RBAC system, users belong to roles and privileges are associated with roles rather than individual users. For this scenario, we form profiles of roles which make our approach usable for database management systems (DBMSs) that have a large user population; in this scenario, we apply the naive Bayesian classifier which shows accurate results in practice. We also employ multilabeling classification to enhance accuracy when the access patterns are common to multiple roles. The second application scenario is when the DBMS does not apply RBAC. In this scenario, we apply the COBWEB clustering method. Experimental results indicate that our techniques are very effective. WIREs Data Mining Knowl Discov 2016, 6:231–239. doi: 10.1002/widm.1195 This article is categorized under: Application Areas > Science and Technology

show abstract

Section: Methodology and System Architecturementioning

confidence: 99%

Section: Query Representationmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Data and syntax centric anomaly detection for relational databases

Sallam

Fadolalkarim

Bertino

et al. 2016

WIREs Data Min & Knowl

Self Cite

View full text Add to dashboard Cite

show abstract

“…DBSAFE-An Anomaly Detection System to Protect Databases From Exfiltration Attempts is proposed by Asmaa Sallam ; Elisa Bertino ; Syed Rafiul Hussain ; David Landers ; R. Michael Lefler ; Donald Steiner et al [3]. Outline and assessment of DBSAFE, a framework to recognize, caution on, and react to irregularities in database get to planned particularly for social database administration frameworks (DBMS).…”

Section: Literature Surveymentioning

confidence: 99%

Tracking Database Access Design by Solicitation Programs for Detecting Inconsistency

Muthuselvan,

Rajaprakash

et al. 2019

IJRTE

View full text Add to dashboard Cite

Database Management Systems (DBMSs) offer get the opportunity to control segments that grant database heads (DBAs) to permit application programs get to advantages to databases. In spite of the way that such instruments are successful, for all intents and purposes better grained get the opportunity to control framework modified to the semantics of the data set away in the DMBS is required as a best in class opposition part against sharp aggressors. Verifying a database alone isn't adequate for such applications, as aggressors going for taking data can misuse vulnerabilities in the unique applications and make these applications to give malevolent database questions. In this paper, we show the structure of an irregularity ID framework that hopes to handle such issue. Our methodology is based the assessment and profiling of the application remembering the ultimate objective to make a short depiction of its relationship with the database. Such a profile keeps an imprint for each submitted inquiry and moreover the relating prerequisites that the application program must satisfy to show the request. Subsequently, in the ID arrange, at whatever point the application gives an inquiry, a module gets the request before it accomplishes the database and affirms the looking at imprint and objectives against the present setting of the application. In case there is a befuddle, the request is separate as exceptional.

show abstract