A database intrusion detection system (DIDS) is used to detect potential violations in database security. DIDS follows other traditional database security mechanisms and network security mechanisms such as firewall and network intrusion detection. Therefore, it faces the intrusion from internal users or the intrusion that can be passed through other security layers. This means that the number of intrusion event is rare compared to the number of the normal event. Therefore, it is not efficient to raise a large number of false alarms to achieve a high detection rate. This paper introduces an enhancement for the data dependency model and integrates it with access control to override the high rate of false alarm and increase the detection rate.

The database security is one of the important issues that should take a complete attention from researchers. Although applying the traditional security mechanisms, the database still violate from both of external and internal users. So, the researchers develop a Database Intrusion Detection System (DBIDS) to detect intrusion as soon as it occurs and override its malicious affects. The previous work developed a DBIDS as a third party product which is isolated from the DBMS security functions especially access controls. The lack of coordination and inter-operation between these two components prevent detecting and responding to ongoing attacks in real time, and, it causes high false alarm rate. On the other hand, one of the directions that are followed to build a profile is the data dependency model. Although this model is sufficient and related to the natural of database, it suffers from high false alarm rate. This means that it needs an enhancement to get its benefits and eliminate its drawbacks. This Paper aims to strengthen the database security via applying a DBID. To achieve this goal it develops an efficient IDS for DB and integrates it with DBMS for cooperation and completeness between the different parts in the security system. The experiments declare that the proposed model is an efficient DBIDS with a minimum false positive rate (nearly zero %) and maximum true positive rate (nearly 100%). Moreover, it is based on a novel method to build an accurate normal user profile and integrate it with access control. General TermsDatabase, Security.