Simulating User Activity for Assessing Effect of Sampling on DB Activity Monitoring Anomaly Detection

Autor:	Oded Sofer, Hagit Grushka-Cohen, Ofer Biller, Lior Rokach, Bracha Shapira
Rok vydání:	2019
Předmět:	Activity monitoring Database activity monitoring Computer science Bayesian probability Sampling (statistics) Anomaly detection Data breach Data mining Baseline (configuration management) computer.software_genre Database transaction computer
Zdroj:	Policy-Based Autonomic Data Governance ISBN: 9783030172763 PADG@ESORICS
Popis:	Monitoring database activity is useful for identifying and preventing data breaches. Such database activity monitoring (DAM) systems use anomaly detection algorithms to alert security officers to possible infractions. However, the sheer number of transactions makes it impossible to track each transaction. Instead, solutions use manually crafted policies to decide which transactions to monitor and log. Creating a smart data-driven policy for monitoring transactions requires moving beyond manual policies. In this paper, we describe a novel simulation method for user activity. We introduce events of change in the user transaction profile and assess the impact of sampling on the anomaly detection algorithm. We found that looking for anomalies in a fixed subset of the data using a static policy misses most of these events since low-risk users are ignored. A Bayesian sampling policy identified 67% of the anomalies while sampling only 10% of the data, compared to a baseline of using all of the data.
Databáze:	OpenAIRE
Externí odkaz:	https://explore.openaire.eu/search/publication?articleId=doi_________::f35839370031178135df86b3a28bf268 https://doi.org/10.1007/978-3-030-17277-0_5 Zobrazit plný text záznamu