Design And Implementation Of Relation Database Intrusion Detection System

With the proliferation of computer and network techniques, database security has become an important research area of information security. Intrusion Detection is an important means to achieve database security. The project studies the techniques of the implementation of Intrusion Detection on Secure DBMS SDM3. It is one of the key techniques of the implementation of a secure database management system, the research is mainly focused on the techniques of implementation of Misuse Detection and Anomaly Detection.Signature analysis is chosen to be the means of intrusion analysis in order to perform well in detection. Misuse Detection security rule database is based on known and found intrusion behaviours; rule browse, addition, deletion and revision are implemented in the management of Misuse Detection rule database; four abnomal behaviour types, which include login at illegal time or from illegal site, login failure, access record failure and access table failure, can be detected.Anomaly Detection based on DBMS refers to traditional Anomaly Detection based on OS and network. The key problem of Anomaly Detection is how to get normal usage profile and compare normal usage profile with current usage profile. Data mining method is used to solve Anomaly Detection problems based on DBMS, distance measure is introduced to guide profile mining. The notion of distance measure refers to domain knowledge and reflect data structure and semantics in DBS in order to exactly describe the usage profile of database users. Role profile is selected because it may give rise to more general and regular patterns than user profile. Correlation is introduced to guide profile comparision to make the result of comparision more reasonable than traditional profile comparision.