基于OCAR挖掘的数据库异常检测模型  

Database anomaly detection model based on mining object-condition association rules

作　　者：戴华[1] 秦小麟[1] 刘亮[1] 柏传杰[1] 

机构地区：[1]南京航空航天大学信息科学与技术学院

出　　处：《通信学报》2009年第9期7-14,共8页Journal on Communications

基　　金：国家自然科学基金资助项目(60673127);国家高技术研究发展计划("863"计划)基金资助项目(2007AA01Z404);江苏省科技支撑计划基金资助项目(BE2008135)~~

摘　　要：提出了一种基于OCAR挖掘的数据库异常检测模型,通过对含有WHERE条件的SQL语句唯一确定的完全条件表达式进行特征提取和形式化分析,挖掘表征用户正常行为模式的目标—条件关联规则集(OCARS),并利用OCARS进行数据库异常检测,给出了针对OCARS的挖掘算法和异常检测算法,并给出针对事务异常检测扩展方案。最后,通过SQL注入检测实验对模型的性能和应用作了分析。A database anomaly detection model based on mining object-condition association rules （OCAR） was proposed. Through analyzing and formalizing the only maximum conditional expression of SQL statements with WHERE clause, the object-condition association rule sets （OCARS） are mined, which represent normal user patterns. And the OCARS are used in anomaly detection. Additionally, OCARS mining algorithm and anomaly detection algorithm were given, and they could be easily used in anomaly transaction detection mechanism. In the end, the experiments about detecting SQL injection were given, and the performance and application were also analyzed.

关 键 词：数据库安全 异常检测 数据挖掘 目标-条件关联规则 

分 类 号：TP392[自动化与计算机技术—计算机应用技术]