Securing data warehouses from web-based intrusions

Authors:
Ricardo Jorge Santos;Jorge Bernardino;Marco Vieira;Deolinda M. L. Rasteiro
Affiliations:
CISUC --- DEI --- FCTUC, University of Coimbra, Coimbra, Portugal;CISUC --- DEIS --- ISEC, Polytechnic Institute of Coimbra, Coimbra, Portugal;CISUC --- DEI --- FCTUC, University of Coimbra, Coimbra, Portugal;DFM --- ISEC, Polytechnic Institute of Coimbra, Coimbra, Portugal
Venue:
WISE'12 Proceedings of the 13th international conference on Web Information Systems Engineering
Year:
2012

Citing 7
Cited 0

Probabilistic Alert Correlation

RAID '00 Proceedings of the 4th International Symposium on Recent Advances in Intrusion Detection
Learning Fingerprints for a Database Intrusion Detection System

ESORICS '02 Proceedings of the 7th European Symposium on Research in Computer Security
A data mining approach for database intrusion detection

Proceedings of the 2004 ACM symposium on Applied computing
Online detection of malicious data access using DBMS auditing

Proceedings of the 2008 ACM symposium on Applied computing
Detecting anomalous access patterns in relational databases

The VLDB Journal — The International Journal on Very Large Data Bases
A data-centric approach to insider attack detection in database systems

RAID'10 Proceedings of the 13th international conference on Recent advances in intrusion detection
A framework for the application of association rule mining in large intrusion detection infrastructures

RAID'06 Proceedings of the 9th international conference on Recent Advances in Intrusion Detection

Quantified Score

Hi-index	0.00

Visualization

Abstract

Decision support for 24/7 enterprises requires 24/7 available Data Warehouses (DWs). In this context, web-based connections to DWs are used by business management applications demanding continuous availability. Given that DWs store highly sensitive business data, a web-based connection provides a door for outside attackers and thus, creates a main security issue. Database Intrusion Detection Systems (DIDS) deal with intrusions in databases. However, given the distinct features of DW environments most DIDS either generate too many false alarms or too low intrusion detection rates. This paper proposes a real-time DIDS explicitly tailored for web-access DWs, functioning at the SQL command level as an extension of the DataBase Management System, using an SQL-like rule set and predefined checkups on well-defined DW features, which enable wide security coverage. We also propose a risk exposure method for ranking alerts which is much more effective than alert correlation techniques.