Conditional adherence based classification of transactions for database intrusion detection and prevention

In recent times, database security has become a major concern of organizations and protection against privilege abuse has gained pivotal importance We present a novel approach for classification of database transactions based on association rules and cluster analysis (CDTARCA) which detects and prevents malicious transactions from modifying any sensitive information in a database Association rules are obtained by mining user data access patterns and role profiles are generated by clustering the user activity parameters from database logs. The extent of adherence to the mined rules along with membership of the current user profile in the aforementioned role profile clusters are used to classify the transaction as either malicious or non-malicious. The classification procedure uses adherence as the metric since the real world transactions are never fully compliant to the existing user behavior patterns. Our experimental evaluation on the typical data-set of a bank shows that our CDTARCA algorithm works effectively in detecting and preventing malicious transactions in database systems.