Mining SQL Queries to Detect Anomalous Database Access using Random Forest and PCA

Abstract

Abstract. Data have become a very important asset to many organizations, companies, and individuals, and thus, the security of relational databases that encapsulate these data has become a major concern. Standard database security mechanisms, as well as network-based and host-based intrusion detection systems, have been rendered inept in detecting malicious attacks directed specifically to databases. Therefore, there is an imminent need in developing an intrusion detection system (IDS) specifically for the database. In this paper, we propose the use of the random forest (RF) algorithm as the anomaly detection core mechanism, in conjunction with principal components analysis (PCA) for the task of dimension reduction. Experiments show that PCA produces a very compact, meaningful set of features, while RF, a graphical method that is most likely to exploit the inherent tree-structure characteristic of SQL queries, exhibits a consistently good performance in terms of false positive rate, false negative rate, and time complexity, even with varying number of features.

Anomalous query access detection in RBAC-administered databases with random forest and PCA

“…[5] used tree kernels to model SQL statements and detect intrusions; although using tree kernels enabled them to exploit the structure of the SQL syntax and proved that this, indeed, has a good effect on performance, the method introduced a huge computational overhead, making anomaly detection drastically slow. We have stressed the importance of timely detection in a previous work [27] and have concluded on candidate algorithms that perform well with large query data sets. Therefore, in this paper, we show the…”