A Dynamic Approach to Detect Anomalous Queries on Relational Databases
Mohammad Saiful Islam, Mehmet Kuzu, Murat Kantarcıoğlu · 2015
Protecting sensitive datasets from insider and outsider attacks has been a major concern over the years. Relational Database Management System (RDBMS) has been the de facto standard to store, retrieve and manage large datasets efficiently in the last few years. However, as surprising as it seems, not a lot of works can be found in the literature which protect databases from anomalous accesses. In this paper, we present a novel Intrusion Detection System (IDS) for relational databases. Our primary objective is to protect databases from both insider and outsider threats by detecting anomalous access patterns using Hidden Markov Model (HMM). While most of the previous notable works in this area focus on query syntax to detect anomalous access, our approach takes into account the amount of sensitive information a query result contains to detect a potential intrusion. Finally, our empirical evaluation on the publicly available TPC-H dataset shows that our IDS can detect anomalous query access with a high degree of accuracy.