Application-Level Misuse Detection in Relational DBMS

INTRODUCTION The security goals of a computer system can be specified explicitly by security policies - what actions a subject can or cannot perform on objects under specified conditions. The security policies are enforced by security mechanisms. Compromising the security mechanisms is intrusion whereas violating the security policies without compromising the security mechanisms by legitimate users is insider abuse. Misuse includes both intrusion and insider abuse. Misuse can been handled by signature based and anomaly based approaches [CFMS95]. In signature based detection, audit logs are matched against a database of known attack patterns. In anomaly based detection, it is assumed that the set of intrusive and misuse events equals the set of anomalous events and such anomalies can be detected in the audit records. Profiles are derived from audit logs and policies to characteri