Raid08 dbir
- 1. ###-### title - PI - area###-### title - PI - area DDatabaseatabase IIntrusionntrusion DDetection andetection and RResponseesponse** Ashish Kamra and Elisa Bertino akamra@purdue.edu, bertino@cs.purdue.edu 1. Create profiles that succinctly represent user/application behaviorinteracting with a DBMS. 2. Develop efficient algorithms fordetection of anomalous DBuser/application behavior. 3. Develop novel strategies/mechanisms forresponding to intrusions in context of a DBMS. 4. Implement ourmethods in the PostgreSQL DBMS and highlight implementation issues. * Supported by NSF under Grant No. 0430274 System Architecture Query User Features Assessment Profile Creator Alarm Drop Query No Action Audit Log Training Queries TRAINING PHASE Detection Engine Response Engine Response Policy Base (Extended ECA Policies) Feature Selector Profiles Consult Contributions ON ---------{EVENT} IF-----------{CONDITIONS} THEN-------{ACTION} CONFIRM---{CONFIRMATION ACTION} ELSE--------{ALTERNATE ACTION} Supervised Learning: Roles as Classes Naïve Bayes Classifier Supervised Learning: Roles as Classes Naïve Bayes Classifier Un-supervised Learning: Clustering methods Outlier Detection Test Un-supervised Learning: Clustering methods Outlier Detection Test SQL QUERIES STORED AS ASSOCIATION RULES SQL QUERIES STORED AS ASSOCIATION RULES QUERY RULES query projection attributes => query selection attributes PREDICATE RULES LHS attributes => RHS attributes QUERY RULES query projection attributes => query selection attributes PREDICATE RULES LHS attributes => RHS attributes Future Work Detection Tasks