An event based framework for facilitating database activity tracking
Josip Šaban, Toni Gržinić, Leo Mršić · 2014
During a database analytic investigation investigator tracks intruder's actions on the system until incident occures - the investigator identifies that the intruder has, indeed, accessed the database in an unauthorized way. Combined with the data about the actions following the incident, it is also crucial to collect data about user activity on the server before the incident so that a log of actions can be created. The goal of this paper is to propose which data should be collected before the security incident occurs, focusing on two parts: Users on the level of the operating system which have access to either the shared file system or the direct access to the operating system by using remote connection