Approaches and Challenges in Database Intrusion Detection

Abstract

Databases often support enterprise business and store its secrets. This means that securing them from data damage and information leakage is critical. In order to deal with intrusions against database systems, Database Intrusion Detection Systems (DIDS) are frequently used. This paper presents a survey on the main database intrusion detection techniques currently available and discusses the issues concerning their application at the database server layer. The identified weak spots show that most DIDS inadequately deal with many characteristics of specific database systems, such as ad hoc workloads and alert management issues in data warehousing environments, for example. Based on this analysis, research challenges are presented, and requirements and guidelines for the design of new or improved DIDS are proposed. The main finding is that the development and benchmarking of specifically tailored DIDS for the context in which they operate is a relevant issue, and remains a challenge. We trust this work provides a strong incentive to open the discussion between both the security and database research communities.

A Comprehensive Systematic Literature Review on Intrusion Detection Systems

“…In summary, existing IDSs cannot cope with the dynamic nature of the currently developing attack types [13][14][15][16][17][18][19].…”

Temporal Anomaly Detection: Calibrating the Surprise

“…Intrusion detection methods can be roughly clustered into two basic categories: rules-based and learning-based methods (Santos, Bernardino, and Vieira 2014 , while not strictly a subset of anomaly or intrusion detection, is of some relevance to the temporal setting. Another natural approach is to model the temporal process via a Markov Model or a Hidden Markov Model, as was done in Görnitz, Braun, and Kloft; Soule et al (2015; 2005).…”

Detecting Data Leakage from Databases on Android Apps with Concept Drift

“…There has been extensive level of research in detecting data leakage from databases, but there are still challenges in this field [33]. Chung et al [34] proposed the use of access patterns to databases to detect typical behavior of users.…”