Association Rules-based Database Security Audit System

Database is the core and basis of information systems, which stores important information most organizations live on. The importance of protecting database security is now drawing more and more attention. At present, most information systems have taken certain safety protection measures to ensure the security of database. But these measures are far from enough to meet the needs of the database security protection. When attack happens, it is necessary to know about how the system is attacked and how to restore the database. And it is also essential to know about the specific leak existing in the system and how to obtain the evidence of the attackers. As a result, database security auditing technology emerges as required.This thesis describes the functions, models and taxonomy of database security auditing systems and briefly reviews present database security auditing technologies. Then, it points out the hidden danger existing current database security mechanism and proposes a solution by using data mining in database security auditing.This thesis utilizes data mining technology to design a new database security audit system. It constructs rule base of users'normal behaviors and judges whether users'behaviors are abnormal by comparing users' current behaviors with normal behaviors. This thesis makes comparison among Apriori, AprioriTid and FP-Growth and finds out the most efficient one is AprioriTid. In order to be adaptive to database audit, it proposes an improved algorithm AprioriTid-OPT, which further improves the efficiency of detecting and reduces the pressure of database. In the end, this thesis achieves the basic functions of database security audit system and experimental results prove its effectiveness.