【摘要】 由于数据库系统结构的复杂性,数据库入侵检测比主机和网络入侵检测更复杂,有更多难题需要去解决.该文提出了数据库日志的三种抽象表示法,利用SQL查询结构稳定性,使用序列模式挖掘算法提取角色的序列模式进行数据库入侵检测.同时,考虑到具体数据库系统的应用语义,该文利用数据库系统的聚类函数进行统计相关属性的改变而进行异常检测,两种方法结合起来既考虑了数据库查询结构的稳定性、通用性,又考虑了数据库系统的应用语义,试验结果证明,该综合方法和单一采用这两种方法相比,有较高的准确率,同时有较低的误报率、漏报率.更多还原

【Abstract】 Database intrusion detection is more difficult than host and network intrusion detection,as the database system is complex in its structure.There are many problems to solve in database intrusion detection.This paper proposes three kinds of presentations for database logs,utilizing the stability of SQL query structure and sequential pattern mining algorithm,which extracts the sequential patterns of roles to do intrusion detection.Furthermore,considering the application semantics of the given database,this paper utilizes the clustering functions of the database system to do the statistics of the changes on correlative attributes,so anomaly detection is done.The two methods are combined together considering the stability of the query structure of the database and the generality and the application semantics.Compared with either of the two methods,the test results prove this combined method has higher precision rate and lower false positive rate,false negative rate.更多还原