Research On Database Web Service Behavior's Analysis And Recognition Technology

A large number of very sensitive and valuable data are stored in the database, especially in the Internet environment, the data of database which is protected from being attacked and damaged is exceptionally important. However, the attacks of the database are primarily from the system's internal. Unauthorized operation of the internal staffs or the legitimate user's vandalism, illegal behavior, intrusion detection, and the database can't stop them by itself. The detection of the behavior during the database used or the specified user's is necessary.The behavior of database users are recorded in the database log file. Through the database log files are reviewed and monitored, can timely understand the security of the user's behavior and the database's usage, it can detect the abnormal and lawless act, it can further protect the database in time. In this thesis, under the database security-related issues, I try in the following aspects and research:study of the DB2 database log file formats and access methods, determining to extract the eight elements from the DB2 for behavior analysis; acquires the history and the normal DB2 database log data, after the data preprocessing, then using improved Apriori algorithm to mining the rules of normal behavior, to establish a database which storages many normal behavior rules; and then to create the database model of behavior analysis. Then we can use the behavior analysis model to detect and analyze user's behavior on the database is normal and abnormal, the normal behavior of the suspected attack can be study by security persons to complete rule base learned.Finally, in this thesis, I use four criterias such as the abnormal behavior detection rate, the false alarm rate of abnormal behavior, the false negative of abnormal behavior and the learning ability of the rules to evaluate the abnormal behavior of the model testing and learning. The experiments have proved the abnormal behavior detection rate of the model is higher, the false alarm of abnormal behavior and the false negative rate are lower, and the learning ability of behavior is stronger, and the learning ability relates with the correlation between behavioral data which is inputed, the behavior of higher similarity is more easily learned, it gives a reference method to identificate the database web service behavior.