ACM Transactions on Database Systems (TODS)
Security-control methods for statistical databases: a comparative study
ACM Computing Surveys (CSUR)
Extensible/rule based query rewrite optimization in Starburst
SIGMOD '92 Proceedings of the 1992 ACM SIGMOD international conference on Management of data
Database security
NiagaraCQ: a scalable continuous query system for Internet databases
SIGMOD '00 Proceedings of the 2000 ACM SIGMOD international conference on Management of data
The notions of consistency and predicate locks in a database system
Communications of the ACM
Database Management Systems
Transaction Processing: Concepts and Techniques
Transaction Processing: Concepts and Techniques
Incremental Implementation Model for Relational Databases with Transaction Time
IEEE Transactions on Knowledge and Data Engineering
Constraint Processing
VLDB '02 Proceedings of the 28th international conference on Very Large Data Bases
Limiting disclosure in hippocratic databases
VLDB '04 Proceedings of the Thirtieth international conference on Very large data bases - Volume 30
Towards robustness in query auditing
VLDB '06 Proceedings of the 32nd international conference on Very large data bases
Enabling the 21st century health care information technology revolution
Communications of the ACM - Spam and the ongoing battle for the inbox
L-diversity: Privacy beyond k-anonymity
ACM Transactions on Knowledge Discovery from Data (TKDD)
Auditing disclosure by relevance ranking
Proceedings of the 2007 ACM SIGMOD international conference on Management of data
GraphScope: parameter-free mining of large time-evolving graphs
Proceedings of the 13th ACM SIGKDD international conference on Knowledge discovery and data mining
Precomputation of privacy policy parameters for auditing SQL queries
Proceedings of the 2nd international conference on Ubiquitous information management and communication
Proceedings of the twenty-seventh ACM SIGMOD-SIGACT-SIGART symposium on Principles of database systems
A Unified Audit Expression Model for Auditing SQL Queries
Proceeedings of the 22nd annual IFIP WG 11.3 working conference on Data and Applications Security
Simulatable Binding: Beyond Simulatable Auditing
SDM '08 Proceedings of the 5th VLDB workshop on Secure Data Management
Auditing Inference Based Disclosures in Dynamic Databases
SDM '08 Proceedings of the 5th VLDB workshop on Secure Data Management
A tamper-resistant and portable healthcare folder
International Journal of Telemedicine and Applications - Pervasive Health Care Services and Technologies
FRAPP: a framework for high-accuracy privacy-preserving mining
Data Mining and Knowledge Discovery
Query rewriting for detection of privacy violation through inferencing
Proceedings of the 2006 International Conference on Privacy, Security and Trust: Bridge the Gap Between PST Technologies and Business Services
An efficient online auditing approach to limit private data disclosure
Proceedings of the 12th International Conference on Extending Database Technology: Advances in Database Technology
Information disclosure by answers to XPath queries
Journal of Computer Security - Selected papers from the Third and Fourth Secure Data Management (SDM) workshops
Do You Know Where Your Data's Been? --- Tamper-Evident Database Provenance
SDM '09 Proceedings of the 6th VLDB Workshop on Secure Data Management
A conceptual model for privacy policies
SEA '07 Proceedings of the 11th IASTED International Conference on Software Engineering and Applications
Inferring privacy policies for social networking services
Proceedings of the 2nd ACM workshop on Security and artificial intelligence
Journal of the ACM (JACM)
Policy-based management and sharing of sensitive information among government agencies
MILCOM'06 Proceedings of the 2006 IEEE conference on Military communications
PolicyReplay: misconfiguration-response queries for data breach reporting
Proceedings of the VLDB Endowment
Efficient auditing for complex SQL queries
Proceedings of the 2011 ACM SIGMOD International Conference on Management of data
Matching unstructured product offers to structured product specifications
Proceedings of the 17th ACM SIGKDD international conference on Knowledge discovery and data mining
Explaining accesses to electronic health records
Proceedings of the 2011 workshop on Data mining for medicine and healthcare
Statistical analysis for comparison of the key representation database with the original database
International Journal of Business Information Systems
Purpose control: did you process the data for the intended purpose?
SDM'11 Proceedings of the 8th VLDB international conference on Secure data management
Proceedings of the VLDB Endowment
Detecting privacy violations in sensitive XML databases
SDM'05 Proceedings of the Second VDLB international conference on Secure Data Management
Information disclosure by XPath queries
SDM'06 Proceedings of the Third VLDB international conference on Secure Data Management
Malafide intension based detection of privacy violation in information system
ICISS'06 Proceedings of the Second international conference on Information Systems Security
ICISS'06 Proceedings of the Second international conference on Information Systems Security
TrustBus'07 Proceedings of the 4th international conference on Trust, Privacy and Security in Digital Business
International Journal of Reliable and Quality E-Healthcare
On scaling up sensitive data auditing
Proceedings of the VLDB Endowment
Hi-index | 0.00 |
We introduce an auditing framework for determining whether a database system is adhering to its data disclosure policies. Users formulate audit expressions to specify the (sensitive) data subject to disclosure review. An audit component accepts audit expressions and returns all queries (deemed "suspicious") that accessed the specified data during their execution. The overhead of our approach on query processing is small, involving primarily the logging of each query string along with other minor annotations. Database triggers are used to capture updates in a backlog database. At the time of audit, a static analysis phase selects a subset of logged queries for further analysis. These queries are combined and transformed into an SQL audit query, which when run against the backlog database, identifies the suspicious queries efficiently and precisely. We describe the algorithms and data structures used in a DB2-based implementation of this framework. Experimental results reinforce our design choices and show the practicality of the approach.