Using FP-growth algorithm for database intrusion detection

Databases are frequent targets of intruders as they contain sensitive information. Database intrusion detection systems are used to detect attacks and security policy breaches on the database. These are also used to reduce the effects of these attacks to keep the database consistent. Mining frequent patterns can be used to implement the intrusion detection systems.;We implement the algorithm to find frequent data units and data objects (read write set). Furthermore, traditional FP-growth algorithm is modified to implement it on the workflows to generate frequent pattern transactions in the workflows. Using a simulation analysis, the efficiency of our approach is verified.;In this research, we use Frequent Pattern (FP)-growth algorithm, one of the association algorithms, to mine frequent data items from large databases without the generation of candidate sets. Repeated database scans are avoided by implementing this algorithm by which both time and resources can be saved. The required statistics from large databases are gathered into a smaller data structure (FP-tree), which is generated with just two database scans. This FP-tree is used to generate frequent patterns in transactions. These patterns are used as profiles to check against future transactions. Transactions that do not match these patterns are identified as malicious transactions.