Intrusion Detection in RBAC-administered Databases

A considerable effort has been recently devoted to the development of Database Management Systems (DBMS) which guarantee high assurance security and privacy. An important component of any strong security solution is represented by intrusion detection (ID) systems, able to detect anomalous behavior by applications and users. To date, however, there have been very few ID mechanisms specifically tailored to database systems. In this paper, we propose such a mechanism. The approach we propose to ID is based on mining database traces stored in log files. The result of the mining process is used to form user profiles that can model normal behavior and identify intruders. An additional feature of our approach is that we couple our mechanism with Role Based Access Control (RBAC). Under a RBAC system permissions are associated with roles, usually grouping several users, rather than with single users. Our ID system is able to determine role intruders, that is, individuals that while holding a...

• Type: Conference
• Year: 2005
• Where: ACSAC
• Authors: Elisa Bertino, Ashish Kamra, Evimaria Terzi, Athena Vakali
• Keywords: ACSAC 2005, Database, Id Mechanism, Normal Behavior, Security Privacy