Detecting anomalous access patterns in relational databases

Kamra, Ashish; Terzi, Evimaria; Bertino, Elisa

doi:10.1007/s00778-007-0051-4

Cited by 163 publications

(102 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Prior studies (e.g., [9][10][11][12][13][14]) have led to the development of intrusion detection systems (IDS) that aimed to protect databases from attacks. Our contribution is complementary, and is specifically on analyzing users' interactions with an RDBMS.…”

Section: Main Ideasmentioning

confidence: 99%

“…Indeed, [14] relied on the SQL-expression syntax of queries to construct user profiles. This approach has the advantage that the query processing of the insider detection system is computationally light: a new query is analyzed by some statistical engine; only queries accepted by the engine are then issued to the database.…”

Section: Main Ideasmentioning

confidence: 99%

“…Prior approaches in the literature that most resemble ours are [13] and [14]. The solution in [13] is similar in the use of statistical measurements; however the focus of the approach is mainly on detecting anomalies in database modification (e.g., inserts) rather than queries).…”

Section: Related Workmentioning

confidence: 99%

“…The query anomaly detection component is mentioned only in passing and only a limited set of features (e.g., session duration, number of tuples affected) are considered. The recent syntax-based work in [14] has the same overall detection goals as our work: detection of anomalies in database access by means of user queries. A primary focus on this paper will be on exposing the limitations of syntax based detection schemes; the approach in [14] will be used in this paper as a benchmark for evaluating the performance of our approach.…”

Section: Related Workmentioning

confidence: 99%

“…Consequently, SQL expressions are poor discriminators of users' intents. For example, a syntax-based approach may model a query with a frequency vector, each of whose coordinates counts the number of occurrences (or marks the presence) of some keywords or mathematical operators [14].…”

Section: Limitations Of Syntax-centric Approachmentioning

confidence: 99%

See 4 more Smart Citations

A Data-Centric Approach to Insider Attack Detection in Database Systems

Mathew

Petropoulos

Ngo

et al. 2010

Lecture Notes in Computer Science

119

View full text Add to dashboard Cite

Abstract. The insider threat against database management systems is a dangerous security problem. Authorized users may abuse legitimate privileges to masquerade as another user or to maliciously harvest data. We propose a new direction to address the problem. We model users' access patterns by profiling the data points that users access, in contrast to analyzing the query expressions in prior approaches. Our data-centric approach is based on the key observation that query syntax alone is a poor discriminator of user intent, which is much better rendered by what is accessed. We present a feature-extraction method to model users' access patterns. Statistical learning algorithms are trained and tested using data from a real Graduate Admission database. Experimental results indicate that the technique is very effective, accurate, and is promising in complementing existing database security solutions. Practical performance issues are also addressed.

show abstract

Section: Main Ideasmentioning

confidence: 99%

Section: Main Ideasmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Limitations Of Syntax-centric Approachmentioning

confidence: 99%

See 3 more Smart Citations

A Data-Centric Approach to Insider Attack Detection in Database Systems

Mathew

Petropoulos

Ngo

et al. 2010

Lecture Notes in Computer Science

119

View full text Add to dashboard Cite

show abstract

An extensive review of data security infrastructure and legislature

Bhavnani

Bardia

Modi

et al. 2021

Security and Privacy

View full text Add to dashboard Cite

The last few decades have witnessed technology progress with leaps and bounds leading to the creation and global adoption of different types of digital devices and platforms that can make personalized recommendations to an individual. One of the consequences of the ubiquity of these devices is the daily generation of data in large quantities. This data includes the sensitive data of an individual as well as multinational organizations and therefore, it must be always kept confidential to prevent its theft and misuse by malicious parties. However, the large volumes of data generated make it difficult to create a robust security solution to safeguard the data from different types of cyberattacks. The paper contributes to the data security industry by consolidating numerous data security algorithms that change with the infrastructure that the data is amid and also outlines the regulations surrounding it. This review paper also aims to highlight the benefits and drawbacks of the security algorithms proposed by researchers to encourage further discussion and consideration of the algorithms for their potential implementation in appropriate domains and also inspire them to develop more powerful and robust security algorithms to cover the drawbacks of the existing ones.

show abstract

Data and syntax centric anomaly detection for relational databases

Sallam

Fadolalkarim

Bertino

et al. 2016

WIREs Data Min & Knowl

Self Cite

View full text Add to dashboard Cite

Recent studies show that insider attacks that aim at exfiltrating data are very common and that these attacks are performed according to specific patterns. Protecting against such threats requires complementing existing security techniques, such as access control and encryption, with tools able to detect anomalies in data accesses. In this paper, we present a technique specifically tailored for detecting anomalous database accesses. Our technique extracts users’ access patterns based on both the syntax of the input queries and the amount of data in their output results. Our technique is based on mining SQL queries in database audit logs in order to form profiles of the normal users’ access patterns. New queries are checked upon these profiles, and deviations from these profiles are considered anomalous and thus indicative of possible attempts to exfiltrate or misuse the data. Our technique works under two application scenarios. The first is when the database has role‐based access control (RBAC) in place. Under an RBAC system, users belong to roles and privileges are associated with roles rather than individual users. For this scenario, we form profiles of roles which make our approach usable for database management systems (DBMSs) that have a large user population; in this scenario, we apply the naive Bayesian classifier which shows accurate results in practice. We also employ multilabeling classification to enhance accuracy when the access patterns are common to multiple roles. The second application scenario is when the DBMS does not apply RBAC. In this scenario, we apply the COBWEB clustering method. Experimental results indicate that our techniques are very effective. WIREs Data Mining Knowl Discov 2016, 6:231–239. doi: 10.1002/widm.1195 This article is categorized under: Application Areas > Science and Technology

show abstract

Detecting anomalous access patterns in relational databases

Cited by 163 publications

References 21 publications

A Data-Centric Approach to Insider Attack Detection in Database Systems

A Data-Centric Approach to Insider Attack Detection in Database Systems

An extensive review of data security infrastructure and legislature

Data and syntax centric anomaly detection for relational databases

Contact Info

Product

Resources

About