A System for Profiling and Monitoring Database Access Patterns by Application Programs for Anomaly Detection

摘要: Database Management Systems (DBMSs) provide access control mechanisms that allow database administrators (DBAs) to grant application programs privileges databases. Though such are powerful, in practice finer-grained mechanism tailored the semantics of data stored DMBS is required as a first class defense against smart attackers. Hence, custom written applications which databases implement an additional layer control. Therefore, securing alone not enough for applications, attackers aiming at stealing can take advantage vulnerabilities privileged and make these issue malicious queries. An only prevent from accessing authorized, but it unable misuse authorized access. we need able detect behavior resulting previously applications. In this paper, present architecture anomaly detection mechanism, DetAnom , aims solve problem. Our approach based analysis profiling order create succinct representation its interaction with database. Such profile keeps signature every submitted query also corresponding constraints program must satisfy submit query. Later, phase, whenever issues query, module captures before reaches verifies current context application. If there mismatch, marked anomalous. The main our that, build profiles, neither any previous knowledge nor example possible attacks. As result, protect attacks code modification attacks, SQL injections, other data-centric well. We have implemented software testing technique called concolic PostgreSQL DBMS. Experimental results show close accurate, requires acceptable amount time, incurs low runtime overhead.