Intrusion Detection and Containment in Database Systems. Abhijit Bhosale M.Tech (IT) School of Information Technology, IIT Kharagpur

Transcription

1 in Database Systems Abhijit Bhosale M.Tech (IT) School of Information Technology, IIT Kharagpur

2 Topics Intrusion and Intrusion Detection Intrusion Detection in Database Systems Data Mining Approach Intrusion Detection in Real-time Database Systems Misuse Detection System for Database Systems Recovery from Malicious Transactions Malicious Activity Recovery Transaction (MART) Repair using Transaction Dependency Graph in Database Systems 2

3 Intrusion Intrusion: The act of wrongfully entering upon, seizing, or taking possession of the property of another Types of Attacks Outsider : Can be defended using physical protection and strong network security mechanisms. Insider : Usually Harder to defend in Database Systems 3

4 Intrusion Detection Detection Techniques Misuse Detection Detect know patterns of intrusions Anomaly Detection Suspect the anomalous behaviors in Database Systems 4

5 Intrusion Detection in Databases Under threat by insider attacks Intruders get access to database by employing SQL Injection to poorly coded web-based applications or by stealing password of legitimate user Very few existing misuse detection systems have concepts of misuse detection in database systems in Database Systems 5

6 Data Mining Approach Proposed by Yi Hu and Brajendra Panda Uses data dependencies (access correlation) among the data items to generate association rules The rules give dependency of read/write operations of some items on write operations of some items Less sensitive to user behavior changes in Database Systems 6

7 Data Mining Approach (cont.) Definitions Sequence: It s an ordered list of read and/or write operations. E.g. <r(x), w(x),c> Read sequence for data item x is a sequence containing w(x) preceded by all the read operations performed on different data items in the same transaction. E.g. <r(y),r(z),w(x)> Write sequence for data item x is a sequence containing w(x) followed by all the write operations performed on different data items in the same transaction. E.g. <w(x), w(a), w(b)> Weight of Data Dependency : It indicates to what extend a data item x depends on other data items in the red or write sequence. The rweight and wweight denote the weight of read dependency and write dependency respectively. in Database Systems 7

8 Data Mining Approach (cont.) The Methodology Discovering Data Dependency is performed in tree steps Sequential pattern discovery phase : Discover sequential patterns in the database log Sequence set generation phase: Obtain read and write sequence sets. Data dependency rules generation: Read and Write dependency rules The transactions which don t follow the read and write rules are marked as malicious transactions in Database Systems 8

9 Example Sample Transactions Sequential Patterns mined in Database Systems 9

10 Example (cont.) Data Dependency Rules Min confidence = 70% Read and Write Sequence Set in Database Systems 10

11 Intrusion Detection in Realtime Database Systems Proposed by Lee and team Considers Real-time Databases like used for Stock Market Definitions Sensor Transaction: Which are responsible for updating the values of real-time data. Temporal Data objects: values of which change with time Sensor transactions are periodic In every period only one sensor transaction can update temporal data More than one transactions in a period are flagged as malicious transactions in Database Systems 11

12 Misuse Detection System for Database Systems DEMIDS - Proposed by Chung and his team Uses audit logs to generate profiles Profiles are used to detect the misuse behavior Needs to be trained with normal behavior (no intrusion) in Database Systems 12

13 Components of DEMIDS s Architecture in Database Systems 13

14 Recovery from Malicious Transactions Traditional Recovery mechanisms don t address the recovery of malicious transactions Complete rollback and adding compensatory transactions is too time consuming. There can be direct as well as indirectly affected transactions which need to be recovered. in Database Systems 14

15 Intrusion Tolerant Database Systems The systems, which in addition to detect the system, also perform countermeasures to the successful attacks, are called intrusion tolerant systems in Database Systems 15

16 Malicious Activity Recovery Transaction (MART) The flat transaction recovery can only remove direct effect of malicious transactions. MART can solve this problem by nesting the flat transactions under MART. The indirect effect can be removed by doing the roll back of the MART. in Database Systems 16

17 Repair using Transaction Dependency Graph Uses Dependency Graph of bad and suspect transaction and undo the effects of all the bad and suspect transactions Transaction Dependency : Transaction T i is dependent upon T j if T j reads x after it s updated by T i T i does not abort before T j reads x Every transaction that updates x between the time T i updates x and T j reads x is aborted before T j reads x. Every source node in the DG(B) is bad transaction and every non source node is a suspect transaction. If a good transaction is not affected by any bad transaction then than transaction need not be undone in Database Systems 17

18 Repair using Transaction Dependency Graph (cont.) Dependency Graph History log Dependency Graph Dirty Data :A data item is dirty if it s a write set of any bad or suspect transaction. All the dirty data items should be restored to the value they had before the first transaction in DG(B) wrote it. in Database Systems 18

19 References Yi Hu, Brajendra Panda: A data mining approach for database intrusion detection. SAC 2004: Paul Ammann, Sushil Jajodia, Peng Liu, Recovery from Malicious Transactions, IEEE Transactions on Knowledge and Data Engineering, v.14 n.5, p , September 2002 Lee, V. C.S., Stankovic, J. A., Son, S. H. Intrusion Detection in Real-time Database Systems Via Time Signatures. In Proceedings of the Sixth IEEE Real Time Technology and Applications Symposium, Chung, C., Gertz M., and Levitt, K. DEMIDS: A Misuse Detection System for Database Systems. In Third Annual IFIP TC-11 WG 11.5 Working Conference on Integrity and Internal Control in Information Systems, Kluwer Academic Publishers, pages , November in Database Systems 19

20 Questions in Database Systems 20