.png){kind=icon}
返回
An anomaly analysis framework for database systems
.png){kind=icon}
PRE
AI
DOI：10.1016/j.cose.2015.06.004.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Anomaly detection systems are usually employed to monitor database activities in order to detect security incidents. These systems raise an alert when anomalous activities are detected. The raised alerts have to be analyzed to timely respond to the security incidents. Their analysis, however, is time-consuming and costly. This problem increases with the large number of alerts often raised by anomaly detection systems. To timely and effectively handle security incidents, alerts should be accompanied by information which allows the understanding of incidents and their context (e.g., root causes, attack type) and their prioritization (e.g., criticality level). Unfortunately, the current state of affairs regarding the information about alerts provided by existing anomaly detection systems is not very satisfactory. This work presents an anomaly analysis framework that facilitates the analysis of alerts raised by an anomaly detection system monitoring a database system. The framework provides an approach to assess the criticality of alerts with respect to the disclosure of sensitive information and a feature-based classification of alerts according to their associated type of attack. The framework has been deployed as a web-based alert audit tool that provides alert classification and risk-based ranking capabilities, significantly easing the analysis of alerts. We validate the classification and ranking approaches using synthetic data generated through an existing healthcare management system. (C) 2015 Elsevier Ltd. All rights reserved.
Keyword:
Anomaly detection
Data leakage
Risk assessment
Database attack classification
Alert visualization
AI总结
对已上传原文的论文进行重点信息的提取，主要内容包括：简要概述、研究摘要、背景介绍、关键亮点、图文解析、展望与总结。
期刊
C
IF:
5.4
论文数:
4.6K
被引数:
1.4W
机构
引用论文
分享收藏
Macroscopic Control of Helix Orientation in Films Dried from Cholesteric Liquid‐Crystalline Cellulose Nanocrystal Suspensions.png)
ChemPhysChem
OAAI
ChemPhysChemIF0
OAAI分享收藏An incremental frequent structure mining framework for real-time alert correlationCOMPUTERS & SECURITY
COMPUTERS & SECURITYIF5.4
PREAI
分享收藏Characterization and classification of malicious Web traffic恶意Web流量的表征和分类COMPUTERS & SECURITY
COMPUTERS & SECURITYIF5.4
PREAI
分享收藏Information security incident management: Current practice as reported in the literatureCOMPUTERS & SECURITY
COMPUTERS & SECURITYIF5.4
PREAI
分享收藏
查看更多内容