1 / 7

A safeguard to database intrusions

A safeguard to database intrusions. “This paper describes how the fingerprints for database transactions can be represented and presents an algorithm to learn and summarize SQL statements into fingerprints.”

theodore-weeks
Download Presentation

A safeguard to database intrusions

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. A safeguard to database intrusions “This paper describes how the fingerprints for database transactions can be represented and presents an algorithm to learn and summarize SQL statements into fingerprints.” Learning Fingerprints for a Database Intrusion Detection System, By Sin Yeung Lee, Wai Lup Low, and Pei Yuen Wong. October 14-16, LNCS 2502, p. 264ff. Prepared by Yuman Huang

  2. Basic concepts • Database Intrusion refers to “the act of individuals who use the database without authorisation, and those who are authorised, but abuse their privileges”.[1] • DIDAFIT detects database intrusions by matching incoming transactions with fingerprints of the signature database at the application level. • The authors claim that the paper is the only work using SQL transaction fingerprints or signatures to detect database intrusions.

  3. Architecture for DIDAFIT Building up an accurate signature database is an essential part of the architecture. Accurate means “free from error”, i.e. properly classifies SQL statements as “legitimate” or “illegitimate”.

  4. Comments • Criticism Only work on a relational DB, based on SQL injection in a SQL Server environment. The security of the signature/fingerprint database has not been considered in this paper. • Appreciation It’s a way of protecting important database assets, for instance, our credit card numbers at the application level. Database administrator (DBA) plays an important role in the learning process.

  5. The role of a DBA Optional: • To specify a trace log and a set of attributes with implicit meaning for algorithm inputs. • To determine whether an attribute value contains implicit meaning for operations and data sensitivity. An attribute with “implicit meaning” means that its valid values are restricted to a small list of pre-determined values, also carry implications for operations and data sensitivity. Required: • To confirm the legitimacy of a produced fingerprint, before it being included to the signature database.

  6. How DBA may affect the accuracy If DBA has no enough knowledge or experience to play his/her role, not only business rules are overruled because of oversummarised fingerprints, but also illegitimate fingerprints are included to the signature database. • The accuracy of the signature database is ruined. • DIDAFIT is no longera safeguard to database intrusions, but a barrier of database performance.

  7. Questions • Can we use an expert system to support the learning process instead of relying on DBA? • Is it possible to apply the principles of DIDAFIT on an object-oriented DB or a native XML DB?

More Related