Monitoring Insider Attack in Database Systems Using Multiple-Criteria Query Statement Probabilities
1
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
Any malicious attack on the database systems performed by an entrusted group of peoplehaving authorized access is called database insider attack. Even though the insider attack has beenlively researched, it is still far from the practical application. We propose a new approach to improvethe limitations in the previous researches. This approach has four objectives: (1) Multi-PreprocessingAlgorithms to observe a query in multiple perspectives (2) Query Probabilities Based Database InsiderMonitoring Methodology based upon Markov Mathematical Model to record insider’s behavioralpatterns with query and query transition probabilities (3) Query Probabilities Time Series Graph tocreate metrics to monitor the insider’s behavior in order to predict insider attack, and (4) Multi-CriteriaQuery Probabilities Based Insider Attack Monitoring System containing the (1)–(3). The results fromthe evaluation show that the proposed system overcomes the limitations and is also capable to monitorinsider’s behavioral data while the database is being updated.
Abstract
Any malicious attack on the database systems performed by an entrusted group of peoplehaving authorized access is called database insider attack. Even though the insider attack has beenlively researched, it is still far from the practical application. We propose a new approach to improvethe limitations in the previous researches. This approach has four objectives: (1) Multi-PreprocessingAlgorithms to observe a query in multiple perspectives (2) Query Probabilities Based Database InsiderMonitoring Methodology based upon Markov Mathematical Model to record insider’s behavioralpatterns with query and query transition probabilities (3) Query Probabilities Time Series Graph tocreate metrics to monitor the insider’s behavior in order to predict insider attack, and (4) Multi-CriteriaQuery Probabilities Based Insider Attack Monitoring System containing the (1)–(3). The results fromthe evaluation show that the proposed system overcomes the limitations and is also capable to monitorinsider’s behavioral data while the database is being updated.
참고문헌 (18)
- Abramova, V., "NoSQL databases:MongoDB vs Cassandra", Proceedings of the International C* Conference on Computer Science and Software Engineering (C3S2E 2013), pp.14~22 (2013)
- Chagarlamudi, M., "Insider Threat in Database Systems: Preventing Malicious Users’ Activities in Databases", Proceedings of 2009Sixth International Conference on Information Technology:New Generations, (ITNG 2009), pp.1616~1620 (2009)
- Doss, G., "Developing insider attack detection model: A grounded approach", Proceedings of IEEE International Conference on Intelligence and Security Information (ISI 2009), pp.107~112 (2009)
- Greitzer, F., "Modeling Human Behavior to Anticipate Insider Attacks", Journal of Strategic Security, 4(2), pp.25~48 (2011)[DOI]
- Kamra, A., "Detecting anomalous access patterns in relational databases", The VLDB Journal, 17, pp.1063~1077 (2008)[DOI]
- Liu, L., "A Framework for Database Auditing", Proceedings of 2009 Fourth International Conference on Computer Sciences and Convergence Information Technology (ICCIT 2009), pp.982~986 (2009)
- Mathew, S., "A Data-Centric Approach to Insider Attack Detection in Database Systems. LNCS 6307 Recent Advances in Intrusion Detection (RAID)", pp.382~401 (2010), Springer-Verlag
- "MySQL 5.4 performance with logging/from" (2009)[URL]
- "5.2 MySQL Server Logs" (2014)[URL]
- Nithiyanandam, C., "Advanced framework of defense system for prevention of insider’s malicious behaviors", Proceedings of 2012 International Conference on Recent Trends in Information Technology (ICRTIT 2012), pp.434~438 (2012)
- Norris, J. R., "Markov Chains" (1998), Cambridge University Press
- "The PageRank Citation Ranking: Bringing Order to the Web" (1999)[URL]
- "Key findings from the 2013 US State of Cybercrime Survey" (2013)[URL]
- Raissi-Dehkordi, M., "A Multi-Perspective Approach to Insider Threat Detection", Proceedings of Military Communications Conference, pp.1164~1169 (2011)
- Rathod, Y. A., "Database Intrusion Detection by Transaction Signature", Proceedings of 2012 Third International Conference on Computing Communication & Networking Technologies (ICCCNT), pp.1~5 (2012)
- "Common Sense Guide to Mitigating Insider Threats/from" (2012)[URL]
- Wei, J., "Analysis farm: A Cloud-based Scalable Aggregation and Query Platform for Network Log Analysis", Proceedings of 2011 International Conference on Cloud and Service Computing (CSC), pp.354~359 (2011)
- Yu, H., "Mass log data processing and mining based on Hadoop and cloud computing", Proceedings of the 7th International Conference on Computer Science & Education (ICCSE 2012), pp.197~202 (2012)