Detecting intrusion transactions in databases using data item dependencies and anomaly analysis

Abstract

The purpose of the intrusion detection system (IDS) database is to detect transactions that access data without permission. This paper proposes a novel approach to identifying malicious transactions. The approach concentrates on two aspects of database transactions: (1) dependencies among data items and (2) variations of each individual data item which can be considered as time-series data. The advantages are threefold. First, dependency rules among data items are extended to detect transactions that read or write data without permission. Second, a novel behaviour similarity criterion is introduced to reduce the false positive rate of the detection. Third, time-series anomaly analysis is conducted to pinpoint intrusion transactions that update data items with unexpected pattern. As a result, the proposed approach is able to track normal transactions and detect malicious ones more effectively than existing approaches.

Database Security Protection based on a New Mechanism

“…Sensitivity of an attribute signifies how important the attribute is, for tracking against malicious modifications. Researches in [17] also modify the work in [15] by extending the concept of malicious transactions from those that corrupt data to those that either read data or write data or do both without permission. The data-dependency models in [15,16,17] find the association rules between the data items without consideration to who accesses this data.…”

“…Researches in [17] also modify the work in [15] by extending the concept of malicious transactions from those that corrupt data to those that either read data or write data or do both without permission. The data-dependency models in [15,16,17] find the association rules between the data items without consideration to who accesses this data. This may generate a rule that conflicts with access control mechanism for some users, and this will cause false positives and violate the availability of the database for these users.…”

“…Data-dependency: This approach mines dependencies among attributes in a database. The transactions that do not follow these dependencies are marked as malicious transactions [15,16,17]. In [15], researchers pay attention to the sequences that include write operation and delete the sequences that contain read only operations because a write operation is more critical for the database.…”

“…Transactions that are not compliant to the data dependencies generated are flagged as anomalous transactions. This component of our approach follows the main concept of the data dependencies in [15,17] with minor modification. For more details and illustrated example review our models details in [19,20] …”

“…Overall, the powerful of the proposed DBIDS can be specified in two points; modifying the data dependency model for generating an accurate and efficient profile, and integrating the DBIDS with access control for minimizing the false rate and strengthening the database security. In order to clarify the benefit of each point separately, the data dependency model as discussed in [15,17] will be integrated with access control to prove that the integration can refine the performance. Then the modification of the data dependency model will be proposed.…”