Outlier based intrusion detection in databases for user behaviour analysis using weighted sequential pattern mining

Indu Singh

doi:10.1007/s13042-023-02049-4

2023-12-11

PRE

Indu Singh *

Rajni Jindal

DOI：10.1007/s13042-023-02049-4

原文链接

原文求助

摘要

En 中文

With the rise of traffic over wide networks, particularly the internet, and the cloud-based transactions and interactions, database security is important for any organisation. The detection of, and protection from, unauthorised external attacks and insiders abusing privileges is an integral part of database security. To that end, we propose Outlier based Intrusion Detection in Databases for User Behaviour Analysis using Weighted Sequential Pattern Mining (BWSPM), a novel method for the detection of malicious transactions through a sequential flow from outlier detection followed by different behavioural checks at the role-based rule mining component, and finally a user level behavioural check. In the worst case, a transaction has to go through a triple-fold security validation directing the model from generalisation to specification. The Outlier Detection module generates clusters based on the syntactic characteristics of transactions and detects transactions that do not adhere to their closest cluster. Role-level analysis is based upon mining rules that capture dynamic usage of attributes local to every role domain, and the transactions are verified against these rules. Finally, User behaviour profiling models user behaviour based on past transactions, and the incoming transaction is flagged if it diverges from that. Security checks are made at every level to prevent further transaction analysis to reduce false positive rate and achieve a higher degree of optimisation. Encouraging results, with levels of accuracy of around 86.4%, were obtained through our approach after conducting experiments on a dataset generated using the TPC-C (Transaction Processing Performance Council) benchmark.

Keyword:

Database intrusion detection

Weighted sequential pattern mining

Dynamic sensitivity

Fuzzy clustering

User behaviour analysis

Outlier detection