Authors:
Pierrette Annie Evina
1
;
Faouzi Jaidi
1
;
2
;
Faten Labbene Ayachi
1
and
Adel Bouhoula
3
Affiliations:
1
University of Carthage, Higher School of Communication of Tunis (Sup'Com), LR18TIC01 Digital Security Research Lab, Tunis, Tunisia
;
2
University of Carthage, National School of Engineers of Carthage, Tunis, Tunisia
;
3
Arabian Gulf University Department of Next-Generation Computing, College of Graduate Studies, Kingdom of Bahrain
Keyword(s):
Anomaly Detection, Vulnerability Mask, Access Control, Databases Security.
Abstract:
In Information Systems (IS) and specifically in databases, both internal and external attacks require a lot of attention. Due to inadequate manipulations in these systems, the access control policy (ACP) which is designed to control and protect resources from non-authorized users, may be subject to diverse alterations in its expression with significant anomalies. In the present paper, we study and establish basic scenarios that are encountered in such circumstances. We discuss other advanced scenarios based on correlation cases between basic ones. We mainly consider three basic concepts: Hidden User, Corrupted User and ACP vulnerability. Our contribution consists in the definition of a vulnerability mask, which makes it possible to calculate all the critical objects and to classify malicious users. This allows fine and reliable configuration of the risk management systems and the audit system as well as an objective and optimized analysis of log files and audit data. We present the a
rchitecture of our approach for the detection of anomalies in a correlated risk management context. Our contribution specifically considers groups of anomalies for which occurrences are linked both temporally and spatially.
(More)