一种数据库入侵检测模型的设计

Design of a model of database intrusion detection

为检测数据库管理系统中的异常事务,提出了一种新的数据库入侵检测模型。该模型运用数据挖掘方法从用户历史会话记录中挖掘用户SQL模板频繁序列,构建用户轮廓。检测时依据用户会话异常度来判断是否发生入侵,既可以有效检测异常事务,又可以避免因为一两次误用把无辜用户误认为恶意攻击者。该模型检测粒度得当,维护较简单。

In order to detect anomalous transactions in a DBMS, a new intrusion detection method is proposed. The method is capable of extracting user profiles from the normal historical audit data by using the AprioriAll algorithm. Since whether a session is abnormal or not is determined by its degree of abnormity, the model can not only detect abnormal transactions efficiently, but it can also avoid mistaking an innocent user for a malicious attacker. Its detection granularity is finer and its maintenance is much easier.