Deriving Composite Periodic Patterns from Database Audit Trails

Zimniak, Marcin; Getta, Janusz R.; Benn, Wolfgang

doi:10.1007/978-3-319-05476-6_32

Cited by 3 publications

(8 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This method can be classified into two categories: syntax-based query auditing and data-based query auditing. In syntax-based query auditing [20], normal syntax patterns are interactively specified. The queries different from the normal patterns are regarded as anomaly [11,12].…”

Section: Database Auditmentioning

confidence: 99%

See 1 more Smart Citation

A Data-Driven Evaluation for Insider Threats

Sun

Bertino

et al. 2016

Data Sci. Eng.

View full text Add to dashboard Cite

Insiders are often legal users who are authorized to access system and data. If they misuse their privileges, it would bring great threat to system security. In practice, we could not have any knowledge about fraud pattern in advance, and most malicious behaviors are often in accordance with security rules; thus, it is difficult to predefine regulations for preventing all kinds of frauds. In this paper, we propose a data-driven evaluation model to detect malicious insiders, which audits user behaviors from both parallel and incremental aspects. Users are grouped together according to their positions and responsibilities, based on which the normal pattern is learned. For each user, a routine behavior pattern is also learned for historical assessment. Then, users are evaluated against both group patterns and routine patterns by probabilistic methods. The deviation degree is adopted as an evidence to justify an anomaly. We also recognize the abnormal activities that often make a user behavior much deviate, which can help an administrator revisit security policies or update activity weights in assessment. At last, experiments are performed on several real dataset.

show abstract

Section: Database Auditmentioning

confidence: 99%

“…Collusion detection usually appears in specific situation, such as P2P systems [26], online rating systems [12,20,23], and so on. Online rating systems are subject to collusion attack mainly by posting unfair rating score collaboratively.…”

Section: Collusion Analysismentioning

confidence: 99%

A Data-Driven Evaluation for Insider Threats

Sun

Bertino

et al. 2016

Data Sci. Eng.

View full text Add to dashboard Cite

show abstract

“…A model of workload trace described in this section is based on the model developed earlier for the audit trails in database systems [19]. Let |U| denotes the total number of time units in U and let U[n] denotes the n-th time unit in U where n changes from 1 to |U|.…”

Section: By L(e)mentioning

confidence: 99%

“…The model of periodicity considered in this paper is a variant of the model introduced in [2] for periodic processes. An initial idea and the first system of derivation rules for the periodic patterns have been proposed in [19].…”

Section: Previous Workmentioning

confidence: 99%

“…For example, [19] defines C as a nonempty sequence of multisets of syntax trees of relational algebra expressions implementing SQL statements, R is a pair of the ordinal numbers of time unit where the repetitions of a carrier start and end, and P is a total number of time units between two adjacent repetition plus one. In [2] C is defined as a multiset e k of an event e, R is defined as a pair of numbers f:t that determine the first and the last repetition of a carrier and P is defined as a pair of numbers n:x that determine the minimal and maximum distance between any two adjacent repetitions of a carrier.…”

Section: By L(e)mentioning

confidence: 99%

See 1 more Smart Citation

Deriving Complex Periodic Patterns from Nested Logs of Events

Getta¹,

Zimniak²

2015

IJKE

Self Cite

View full text Add to dashboard Cite

Abstract-Periodic processing of software components is a simple reflection of a periodic nature of many real world processes where the identical actions are repeated at every given period of time. Discovering periodic patterns in the traces of computations performed in the past allows for better preparation of software systems to meet the demands of high workload times in the future.This work shows how to discover the periodic patterns in the nested logs of computations using the transformations of the simple patterns into the complex ones. The paper defines a concept of periodic pattern and its validation in a reduced nested log of events. A system of derivations rules is defined and followed by a sequence of algorithms that use the rules to create the complex periodic patterns. The paper is concluded with a description of experiment where the sequences SQL statement are transformed into the expressions of extended relational algebra and used as input data to discover the periodic patterns with a method described in the paper.

show abstract

Discovering Complex Incomplete Periodic Patterns through Logical Derivations

Getta¹,

Zimniak²

2015

JSS

Self Cite

View full text Add to dashboard Cite

Discovering complex and incomplete periodic patterns in the logs of events is a complicated and time consuming task. This work shows that it is possible to discover complex and incomplete periodic patterns through finding simple patterns first and through logical derivations of complex and incomplete patterns later on. The paper defines a syntax and semantics of a class of periodic patterns that frequently occur in the logs of events. A system of derivation rules proposed in the paper can be used to transform a set of periodic patterns into a logically equivalent set of patterns. The rules are used in the algorithms that derive complex and incomplete periodic patterns. A prototype implementation of the algorithms that discover complex and incomplete periodic patterns in the logs of events is presented.

show abstract

Deriving Composite Periodic Patterns from Database Audit Trails

Cited by 3 publications

References 9 publications

A Data-Driven Evaluation for Insider Threats

A Data-Driven Evaluation for Insider Threats

Deriving Complex Periodic Patterns from Nested Logs of Events

Discovering Complex Incomplete Periodic Patterns through Logical Derivations

Contact Info

Product

Resources

About