Anomalous Database Transaction Detection By Harshith Reddy Sarabudla

Anomaly detection approaches Command-centric – focus on attack syntax Mostly capture attack queries that have similar columns but process or display different row contents from those of normal queries Data-centric – focus on semantics Mostly capture attack queries that are similar in both columns and resulting datasets

Limitations SELECT Name, Salary FROM Employee WHERE ID = 102 AND Dept_id = 3; Conversely, suppose we rewrite the above query as follows SELECT Name, Salary FROM Employee WHERE ID = 102 AND Dept_id = 3 AND Name IS NOT NULL; Both queries are syntactically different but produces the same result. However, the second syntax is likely to be flagged as anomalous and ends up be a false positive.

Importance of problem: Abundance of false alerts (most of them being false positive) makes it difficult for the security analyst to identify successful attacks and to take remedial actions.

Challenging aspects We propose a solution for detecting anomalous transactions in the database more efficiently while Focusing on reducing the number of false positives Reducing the detection time window Handling detection for newly added attributes

Proposed solution Training Phase: Features that represent the syntax of the queries are extracted for legitimate transactions taken collected from DBMS audit logs. Features: SQL operations, attributes, user role, number of commands and command execution time Signatures are created for all legitimate transactions Detection Phase: Stage 1 – Syntax based detection Compare Incoming transaction signature with collected signatures Stage 2 – Data usage-based detection Attributes are grouped according to their frequency of usage for each user role and compared Stage 3 - Data sensitivity-based detection Compare the amount of sensitive information the transaction returns

Future work Anomaly detection algorithms may be modified according to the workload or data size of the database Measure the impact of alerts for admin to prioritize them in taking action