Intrusion Response System for Relational Databases by using Secondary Level Authentication

The intrusion response component of an overall intrusion detection system is responsible for issuing a suitable response to an anomalous request. We propose the Secondary Service Link Authenticator (SSLA) to support the intrusion response system. We follow the notion of database response policies to support our intrusion response system tailored for a DBMS. The interactive response policy language makes it very easy for the database administrators to specify appropriate response actions for different circumstances depending upon the nature of the anomalous request. The two main issues that we address in context of such response policies are that of policy matching, and policy administration. For the policy matching problem, we use two algorithms that efficiently search the policy database for policies that match an anomalous request. The experimental evaluation shows that our techniques are very efficient. The other issue that we address is that of administration of response policies to prevent malicious modifications to policy objects from legitimate users. We propose a novel Joint Threshold Administration Model (JTAM) that is based on the principle of separation of duty. The key idea in JTAM is that a policy object is jointly administered by at least k database administrator (DBAs), that is, any modification made to a policy object will be invalid unless it has been authorized by at least k DBAs. The design details of JTAM which is based on a cryptographic threshold signature scheme, and show how JTAM prevents malicious modifications to policy objects from authorized users and follws the SSLA.. We also implement JTAM in the PostgreSQL DBMS, and report experimental results on the efficiency of our techniques.