基于OCAR挖掘的数据库异常检测模型.pdf

第30 卷第9 期 通 信 学 报 Vol.30 No.9 2009 年9 月 Journal on Communications September 2009 基于OCAR 挖掘的数据库异常检测模型 戴华，秦小麟，刘亮，柏传杰 (南京航空航天大学 信息科学与技术学院，江苏 南京 210016) 摘 要：提出了一种基于OCAR 挖掘的数据库异常检测模型，通过对含有WHERE 条件的SQL 语句唯一确定的 完全条件表达式进行特征提取和形式化分析，挖掘表征用户正常行为模式的目标—条件关联规则集（OCARS ）， 并利用OCARS 进行数据库异常检测，给出了针对OCARS 的挖掘算法和异常检测算法，并给出针对事务异常检 测扩展方案。最后，通过SQL 注入检测实验对模型的性能和应用作了分析。 关键词：数据库安全；异常检测；数据挖掘；目标—条件关联规则 中图分类号：TP392 文献标识码：A 文章编号：1000-436X(2009)09-0007-08 Database anomaly detection model based on mining object-condition association rules DAI Hua, QIN Xiao-lin, LIU Liang, BAI Chuan-jie (College of Information Science Technology, Nanjing University of Aeronautics and Astronautics, Nanjing 210016, China) Abstract: A database anomaly detection model based on mining object-condition association rules (OCAR) was pro- posed. Through analyzing and formalizing the only maximum conditional expression of SQL statements with WHERE clause, the object-condition association rule sets (OCARS) are mined, which represent normal user patterns. And the OCARS are used in anomaly detection. Additionally, OCARS mining algorithm and anomaly detection algorithm were given, and they could be easily used in anomaly transaction detection mechanism. In the end, the experiments about de- tecting SQL injection were given, and the performance and application were also analyzed. Key words: database security; anomaly detection; data mining; object-condition association rule 的非法访问，如密码嗅探(password