Wizard: a database inference analysis and detection system

Delugach, Harry S.; Hinke, Thomas H.

doi:10.1109/69.485629

Cited by 43 publications

(19 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A lot of work has been devoted to the inference channel in multilevel secure database. In [13] and [26] for each inference channel that is detected, either the schema of the database is modified or security level is increased. In [13], a conceptual graph based approach has been used to capture semantic relationships between entities.…”

Section: Related Workmentioning

confidence: 99%

Access Control for Data Integration in Presence of Data Dependencies

Haddad

Stevovic

Chiasera

et al. 2014

Database Systems for Advanced Applications

View full text Add to dashboard Cite

Abstract. Defining access control policies in a data integration scenario is a challenging task. In such a scenario typically each source specifies its local access control policy and cannot anticipate data inferences that can arise when data is integrated at the mediator level. Inferences, e.g., using functional dependencies, can allow malicious users to obtain, at the mediator level, prohibited information by linking multiple queries and thus violating the local policies. In this paper, we propose a framework, i.e., a methodology and a set of algorithms, to prevent such violations. First, we use a graph-based approach to identify sets of queries, called violating transactions, and then we propose an approach to forbid the execution of those transactions by identifying additional access control rules that should be added to the mediator. We also state the complexity of the algorithms and discuss a set of experiments we conducted by using both real and synthetic datasets. Tests also confirm the complexity and upper bounds in worst-case scenarios of the proposed algorithms.

show abstract

Section: Related Workmentioning

confidence: 99%

Access Control for Data Integration in Presence of Data Dependencies

Haddad

Stevovic

Chiasera

et al. 2014

Database Systems for Advanced Applications

View full text Add to dashboard Cite

show abstract

“…The non-probabilistic metrics are mainly used in the fields of inference problem of statistical databases [1,17,16,26], multilevel databases [20,5] and general purpose databases [7,5,27]. The most often used one is that if the private value of an individual cannot be uniquely inferred, released data about the individual are considered safe [1,20,7,17,5,16].…”

Section: Related Workmentioning

confidence: 99%

“…The most often used one is that if the private value of an individual cannot be uniquely inferred, released data about the individual are considered safe [1,20,7,17,5,16]. The other one is the cardinality of the set of possible private values for each individual, among which attackers cannot determine which one is the actual one [26,27] (The metric used in [27] is an uncertainty metric in spite of the notion of k-anonymity introduced).…”

Section: Related Workmentioning

confidence: 99%

“…We study the computational complexity as well as practical algorithms. We focus on checking for indistinguishability since checking for uncertainty has been extensively studied [1,7,17,5,26,16,27].…”

Section: Introductionmentioning

confidence: 99%

“…These metrics can be classified into two categories: non-probabilistic and probabilistic. The non-probabilistic metrics are based on whether the private value of an individual can be uniquely inferred from the released data [1,20,7,17,5,16] or whether the cardinality of the set of possible private values inferred for an individual is large enough [26,27]. The probabilistic metrics are based on some characteristics of the probability distribution of…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Indistinguishability: The Other Aspect of Privacy

Yao

Wang

et al. 2006

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Uncertainty and indistinguishability are two independent aspects of privacy. Uncertainty refers to the property that the attacker cannot tell which private value, among a group of values, an individual actually has, and indistinguishability refers to the property that the attacker cannot see the difference among a group of individuals. While uncertainty has been well studied and applied to many scenarios, to date, the only effort in providing indistinguishability has been the well-known notion of k-anonymity. However, k-anonymity only applies to anonymized tables. This paper defines indistinguishability for general situations based on the symmetry among the possible private values associated with individuals. The paper then discusses computational complexities of and provides practical algorithms for checking whether a set of database views provides enough indistinguishability.

show abstract

Maximizing Sharing of Protected Information

Dawson

Vimercati²,

Lincoln

et al. 2002

Journal of Computer and System Sciences

View full text Add to dashboard Cite

Despite advances in recent years in the area of mandatory access control in database systems, today's information repositories remain vulnerable to inference and data association attacks that can result in serious information leakage. Without support for coping against these attacks, sensitive information can be put at risk because of release of other (less sensitive) related information. The ability to protect information diclosure against such improper leakage would be of great benefit to governmental, public, and private institutions, which are, today more than ever, required to make portions of their data available for external release. In this paper we address the problem of classifying information by enforcing explicit data classification as well as inference and association constraints. We formulate the problem of determining a classification that ensures satisfaction of the constraints, while at the same time guaranteeing that information will not be overclassified. We present an approach to the solution of this problem and give an algorithm implementing it which is linear in simple cases, and quadratic in the general case. We also analyze a variant of the problem that is NP-complete. © 2002 Elsevier Science (USA)

show abstract

Wizard: a database inference analysis and detection system

Cited by 43 publications

References 8 publications

Access Control for Data Integration in Presence of Data Dependencies

Access Control for Data Integration in Presence of Data Dependencies

Indistinguishability: The Other Aspect of Privacy

Maximizing Sharing of Protected Information

Contact Info

Product

Resources

About