Investigative Data Warehousing and Mining for Database Security
Areej M. Yassin, Donald J. Berndt, Monica Chiarini · 2006
In this study a preliminary investigative data warehouse is developed to integrate and store very detailed audit data from multiple data sources to support a comprehensive view of database usage and potential security breaches. The data warehouse was populated with real usage data collected from over a year of database use by students in a variety of classes. This data was extracted and seeded with some unusual usage patterns that represent potential intrusions into database systems or misuse by insiders. A pivot table interface is shown as an example of a human-in-the-loop navigation tool for investigating unusual activity at a very detailed level. Market basket analysis is explored as a potential data mining technique for uncovering rare usage patterns. The resulting rules identified most of the seeded patterns demonstrating the potential of