Detecting Privacy Violations in Sensitive XML Databases

Abstract

Abstract. Privacy violations and the exposition of sensitive data to a third party may seriously damage the business of a company. Therefore, it is crucial for the company to identify that set of users that may have exposed the sensitive data. To identify that set of users is a problem, when multiple users must have access rights that allow them to access the exposed sensitive data. Our solution to the problem is based on an analysis of the users' XPath queries. Within a two-step approach, we compare submitted queries with the exposed data to identify suspicious queries.

Disclosure detection over data streams in database publishing

“…The issue of relaxing it was later investigated in [4]. Accordingly, Stefan et al [2] detected privacy violations in sensitive XML databases and proposed an algorithm which identifies a set of suspicious XPath queries with respect to an audit XPath query. Goyal et al [7] proposed an algorithm for rewriting of queries of a specified malafide intension to detect the privacy disclosure through either explicit accesses or inferencing by functional dependencies.…”

A Unified Audit Expression Model for Auditing SQL Queries

“…Earlier work includes Agrawal et al [12] where a simple specification syntax and a notion of suspicion was introduced for single SQL queries in isolation, Motwani et al [13] where the authors have used a similar syntax and have proposed new suspicion notions for a batch of queries, i.e., semantic suspiciousness, strong syntactic suspiciousness, and weak syntactic suspiciousness. Other work in auditing is Böttcher et al [14] where the authors have used audit expression for XML databases and used the similar notion of suspicion as proposed by Agrawal et al in [12]. Consider the following example of an audit expression:…”