Database Intrusion Detection System Design And Implementation

With the rapid development of Internet,database applications to keep up with the pace of global information,more and more government,commercial,and financial institutions and utility companies will be the database to connect to the Internet.However,a variety of attacks and invasion of the continuous development of technology,so that the security database are more at risk.Thus the network database security is the question to be settled urgently.The database connection into the Internet,the network complexity,openness, making internal connections,such as database systems are more vulnerable to attack,while the traditional database security mechanisms which was powerless to do anything.The authors investigate in-depth study,based on the design of a database intrusion detection system model,including the event generator,event analyzer, the incident response unit,the incident database and the management control unit and several other modules.Coordination of management control module generators,analyzers and to respond to the work unit.Database intrusion detection system to achieve the following functions:can detect disguised attack legitimate users of the attacks and attempted attacks on three types of attacks;the use of SQL Server 2000's Profiler tool to create tracking,real-time data acquisition database audit;hybrid detection engine test,that is,the use of two parallel threads-thread misuse detection and anomaly detection thread of audit data detection;with a wide variety of alarm,it can be real-time alerting the client;the incident database invasion unusual event can be maintained,for administrators invasion anomaly detection event statements and weekly/monthly statistical reports to prepare for analysis.In this paper,the design of a database intrusion detection system model, realize the system-related functions,and a related test,has a theoretical significance and practical application value.