13220286
Discovery of Multi-Level Security Policies
With the increasing complexity and dynamics of database systems, it becomes more and more difficult for administrative personnel to identify, specify and enforce security policies that govern against the misuse of data. Often security policies are not known, too imprecise or simply have been disabled because of changing requirements.
14465831
DEMIDS: A Misuse Detection System for Database Systems
Despite the necessity of protecting information stored in database systems (DBS), existing security models are insufficient to prevent misuse, especially insider abuse by legitimate users. Further, concepts for misuse detection in DBS have not been adequately addressed by existing research in misuse detection. Even though there are available means to guard the information stored in a database system against misuse, they are seldom used by security officers because security policies of the organization are either imprecise or not known at all.
921184
Misuse Detection in Database Systems Through User Profiling
Submission for the Paper Misuse Detection in Database Systems Through User Profiling Christina Yip Chung, Michael Gertz, Karl Levitt Department of Computer Science, University of California at Davis {chungy| gertz | levitt @cs.ucdavis.edu} Topic Categories: Misuse/anomaly detection Data mining New IDS methodologies and technologies Christina Yip Chung Ms. Chung received her B.Sci.(Computer Science) degree from the University of Hong Kong in 1996 and her M.Sci.(Computer Science) degree from the University of California, Davis in 1998. She is currently a Ph.D. candidate in the Department of Computer Science at the University of California, Davis. Her research interests include data mining and knowledge discovery, misuse detection and database security. Michael Gertz Dr.Gertz received his M.S. degree in Computer Science from the University of Dortmund, Germany. In 1996 he received his Ph.D. in Computer Science from the University of Hannover, Germany, where he worked as a research and teaching assistant from December 1991 to November 1997. Since October 1997 Dr.Gertz is an Assistant Professor in the Department of Computer Science at the University of California, Davis. Dr.Gertz's research interests are in the design and implementation of distributed, heterogeneous and multidatabase systems with a particular focus on the management of data quality and correctness. His current research is on database integration techniques, database interoperability, constraint maintenance in multidatabase systems and integrity enforcement in temporal databases. Dr.Gertz's research interests also include database security, the design of user interfaces to database systems and database administration tools Karl Levitt Professor Levitt received his Ph.D. from New York University in 1966. He is head of the Computer Security Laboratory in UC Davis. Professor Levitt conducts research in the areas of computer security, automated verification, and software engineering. With respect to computer security he is working on techniques to detect malicious code (viruses, worms, time bombs, etc.) in programs and to detect attempts to penetrate or misuse computer systems, especially computer networks. With respect to verification, he is applying an automated theorem prover (Higher Order Logic HOL) to the verification of hardware and software systems, especially operating systems for safety-critical embedded systems. With respect to software engineering, he is working on new methods for testing programs that make use of heuristic techniques and methods for automating the generation of operating system code from templates. Motivation Concepts for misuse detection in DBS have not been adequately addressed by existing intrusion detection systems (IDS) which reside on the operating system and/or network. Auditing the user behavior at these layers is unsuited for misuse detection at the DBS level because the semantics and structure of the data are not reflected in such low-level audit logs. Intrusion attempts that IDSs fail to detect at the operating system layer may be detected as anomalous events at the database system layer. The success of IDS heavily depends on the domain knowledge available to the system. Domain knowledge of database systems, such as the structure and semantics of the data, is specified explicitly in the data. Database management systems provide a rich set of functionality designed to efficiently process large sets of data and are suitable for processing audit logs. In the proposed approach we derive profiles to describe the typical behavior for users and roles in a relational database system. The profiles generated can be used in detecting misuse behavior. Very often, security officers (SO) do not use the available means to guard against the information stored in the DBS because the security policies are not well known. The profiles derived by our system can serve as a valuable tool for security re-engineering of an organization by helping the SO to define and refine policies and to verify existing policies. Approach Working scopes and distance measure: We conjecture that a user typically will not access all attributes and data in a database schema. Attributes used in a query are related through primary and foreign key dependencies among the relations in a schema. Therefore, the access patterns of users will form some working scopes which are sets of attributes that are usually referenced together with some values. Based on this conjecture, we define the notion of distance measure between sets of attributes that considers both the structure of the data and the user behavior. Our notion of distance measure is used to guide the search for regular patterns in audit data and to describe the typical user behavior. Architecture: Our IDS consists of four components: (1) Auditor, (2) Data Processor, (3) Profiler, and (4) Detector. The Auditor is responsible for selecting the set of features to audit, such as the type of query, the set of attributes referenced by the query, or new and old values of modified data. The Data Processor groups data in the audit log into separate audit sessions. The Profiler derives a profile for each audit session. Based on how the data in the audit log are grouped into audit sessions, different types of profiles are generated, such as profiles for users and roles. The Detector detects misuse by comparing new information about the user behavior against his corresponding profile, and by comparing the profiles with the security policies. Frequent itemset profiler: We propose a noval approach based on the idea of frequent itemsets and the notion of distance measure to discover the working scopes of users and database applications. Our frequent itemsets approach is similar to the clustering approach. Unlike clustering approaches, which are non-scalable, our frequent itemsets profiler is implemented by SQL queries and is scalable to the size of the audit session. The patterns discovered by our frequent itemset profiler are sets of features with their typical values, which are of finer level of granularity than clusters discovered by clustering algorithms which are only sets of objects. Evaluation: We have conducted an analytical analysis on the correctness and completeness of our frequent itemset profiler and conducted preliminary study on its performance and effectiveness.
10520928
Development of an interactive multimedia training simulator for responding to abortion clinic bomb threats
This paper describes the development of an interactive multimedia computer program to provide realistic training for responding to bomb threats targeted at abortion clinics. Because the simulator is computer-based, clinic administrators can receive training that might not otherwise be possible due to time, cost or operational limitations.
9668406
Culturing Evolution Strategies to Support the Exploration of Novel Environments by an Intelligent Robotic Agent
Recently, a lot of attention is paid to the use of evolutionary computing techniques for the development of adaptive robots. This paper presents the use of Cultural Algorithms with Evolution Strategies (ES) to produce optimal solutions to the ball following problem. This involves learning how to find and advance toward a ball. This is a basic skill needed to play robot soccer. Since it is possible that both the ball and the robot can be moving simultaneously this can be a difficult problem to solve. Four different solutions are implemented here. The first is the two member ES with comma strategy, (1,1)-ES. The second is the ES with plus strategy, (1+1)-ES. The third is a cultured version of the (1,1)-ES. The fourth is a cultured version of the (1+1)-ES. In cultural versions, the ES model is the population model for a Cultural Algorithm. The belief space contains generalizations about the individual's ancestral line, e.g. grandparents, in order to guide the modifications. Each of the four systems was tested by loading it into the RAM of a Khpera robot. Each system was then used to learn how to control the direction and speed of the two Khepera robot's wheels in order to direct it to a given ball. The real-time learning results are then compared. The results suggest that simple Evolution Strategies implemented here exhibit a satisfactory level of real-time learning in forwarding and pushing the ball. The cultured version exhibits an improvement in time over this performance as well.
5321290
Testing Concurrent Ada Program with Reproducible Test Cases
17629835
A self-adaptive approach to representation shifts in cultural algorithms
Describes how a formal model of self-adaptation (Angeline, 1995) can be expressed in terms of "cultural algorithms". A particular form of self-adaptation concerns the shifting of the representational bias used to described the set of learned beliefs within the cultural algorithms. A version of a cultural algorithm with the ability to shift its representational bias was used to solve the "royal road" problem suggested by Mitchell, Forrest and Holland (1991). The results of the presented experiments indicate that representational self-adaptations such as this can produce significant performance improvements over systems without such capabilities for problems whose performance function is inherently hierarchical, as is the case for the royal road function.
14748125
Many-Sorted First-Order Logic Database Language
A database languages based on Many-Sorted First-Order Logic (MSFOL) have many advantages over one based on One-Sorted First-Order Logic (OSFOL). The advantages includes ease-of-expressiveness, efficiency, and the abstraction mechanism. Many database researchers have used OSFOL to view the Relational Data Model (RDM) ; however, no RDM has been modelled by MSFOL. This paper first gives a formal definition for MSFOL and then its advantages of expressiveness and of abstraction are illustrated. Two reduction algorithms which can transform an MSFOL-based language into\from an OSFOL-based language are given. The semantic equivalence between languages based on MSFOL and Typed OSFOL is also proved. Recent extensions of RDMs require aggregation, classification, and generalisation/specialisation mechanisms which MSFOL-based languages can provide, but OSFOL-based languages cannot.