A white-box anomaly-based framework for database leakage detection

详细信息    查看全文

• 作者：E. Costante^a ; ^{e.costante@tue.nl} ; J. den Hartog^a ; Milan Petković^a ; ^b ; S. Etalle^a ; ^c ; M. Pechenizkiy^a
• 关键词：Data leakage ; Insider threats ; Database monitoring ; Database intrusion detection
• 刊名：Journal of Information Security and Applications
• 出版年：2017
• 出版时间：February 2017
• 年：2017
• 卷：32
• 期：Complete
• 页码：27-46
• 全文大小：2535 K
• 卷排序：32

文摘

Data leakage is at the heart most of the privacy breaches worldwide. In this paper we present a white-box approach to detect potential data leakage by spotting anomalies in database transactions. We refer to our solution as white-box because it builds self explanatory profiles that are easy to understand and update, as opposite to black-box systems which create profiles hard to interpret and maintain (e.g., neural networks). In this paper we introduce our approach and we demonstrate that it is a major leap forward w.r.t. previous work on the topic in several aspects: (i) it significantly decreases the number of false positives, which is orders of magnitude lower than in state-of-the-art comparable approaches (we demonstrate this using an experimental dataset consisting of millions of real enterprise transactions); (ii) it creates profiles that are easy to understand and update, and therefore it provides an explanation of the origins of an anomaly; (iii) it allows the introduction of a feedback mechanism that makes possible for the system to improve based on its own mistakes; and (iv) feature aggregation and transaction flow analysis allow the system to detect threats which span over multiple features and multiple transactions.