Resource bound analysis for database queries
James Cheney, Morten Dahl · 2008
Many scientific disciplines, such as biology and astronomy, are now collecting large amounts of raw data systematically and storing it centrally in relational databases for shared use by their communities. In many cases such systems accept arbitrary SQL queries submitted using a Web form. Typical database management systems do not provide support for enforcing resource access control policies to guard against expensive or pointless queries submitted accidentally by legitimate users or intentionally by attackers. Instead, such systems typically employ timeouts to halt queries that do not terminate within a reasonable period of time. This approach can limit misuse but cannot prevent it; moreover, it does not provide useful feedback for legitimate users whose queries exceed the time limit.