Anomaly behavior detection of database user based on discrete-time Markov chain
BI Meng
WANG An-di
XU Jian
ZHOU Fu-cai
Abstract：Aiming at the problem of internal attack in the database system, an anomaly detection method based on the user behaviour was introduced into the internal attack detection in the database system. The discrete-time Markov chain ( DTMC ) was applied to the anomaly detection of database system, and an anomaly detection system for user behaviour based on DTMC was established. The SQL statements submitted by the users were taken as the user behavior features and were analyzed. In addition, the behavior features of normal users and behavior to be detected were extracted with DTMC, and the corresponding comparison between them was performed. If the deviation degree of two behavior features was beyond the threshold, the detected behavior would be judged as an anomaly behavior. The feasibility and effectiveness of the proposed system were actually tested. The results show that the proposed system can better describe the user behavior, and can effectively detect the internal attack of database system.
Keywords：network securitydatabase securityuser behaviorinternal attackanomaly detectionintrusion detectionSQL statementdiscrete-time Markov chain( DTMC)
Publication Date：2018-01-01
Online Publishing Date：2025-08-15(First online date of this platform, not the publication date of the document)
Pages：7( 70-76 )