A data damage tracking quarantine and recovery (DTQR) scheme for mission-critical database systems

ABSTRACT

Database security research aims to protect a database from unintended activities, such as authenticated misuse, malicious attacks. In recent years, surviving DBMS from an attack is becoming even more crucial because networks have become more open and the increasingly critical role that database servers are playing nowadays. Unlike the traditional database failure/attack recovery mechanisms, in this paper, we propose a light-weight dynamic Data Damage Tracking, Quarantine, and Recovery (DTQR) solution. We built the DTQR scheme into the kernel of PostgreSQL. We comprehensively study this approach from a few aspects (e.g., system overhead, impact of the intrusion detection system), and the experimental results demonstrated that our DTQR can sustain an excellent data service while healing the database server when it is under a malicious attack.

REFERENCES

• 1: Paul Ammann , Sushil Jajodia , Peng Liu, Recovery from Malicious Transactions, IEEE Transactions on Knowledge and Data Engineering, v.14 n.5, p.1167-1185, September 2002 [doi>10.1109/TKDE.2002.1033782]
• 2: P. Ammann , S. Jajodia , C. D. McCollum , B. T. Blaustein, Surviving information warfare attacks on databases, Proceedings of the 1997 IEEE Symposium on Security and Privacy, p.164, May 04-07, 1997
• 3: Kun Bai , Peng Liu, Towards Database Firewall: Mining the Damage Spreading Patterns, Proceedings of the 22nd Annual Computer Security Applications Conference, p.449-462, December 11-15, 2006 [doi>10.1109/ACSAC.2006.52]
• 4: Daniel Barbará , Rajni Goel , Sushil Jajodia, Using Checksums to Detect Data Corruption, Proceedings of the 7th International Conference on Extending Database Technology: Advances in Database Technology, p.136-149, March 27-31, 2000
• 5: Philip A. Bernstein , Vassco Hadzilacos , Nathan Goodman, Concurrency control and recovery in database systems, Addison-Wesley Longman Publishing Co., Inc., Boston, MA, 1987
• 6: Elisa Bertino , Ashish Kamra , Evimaria Terzi , Athena Vakali, Intrusion Detection in RBAC-administered Databases, Proceedings of the 21st Annual Computer Security Applications Conference, p.170-182, December 05-09, 2005 [doi>10.1109/CSAC.2005.33]
• 7: CERT. Cert advisory ca-2003-04 ms-sql server worm. http://www.cert.org/advisories/CA-2003-04.html, January, 25 2003.
• 8: Tzi-cker Chiueh , Dhruv Pilania, Design, Implementation, and Evaluation of a Repairable Database Management System, Proceedings of the 21st International Conference on Data Engineering, p.1024-1035, April 05-08, 2005 [doi>10.1109/ICDE.2005.49]
• 9: Prahlad Fogla , Wenke Lee, Evading network anomaly detection systems: formal reasoning and practical techniques, Proceedings of the 13th ACM conference on Computer and communications security, October 30-November 03, 2006, Alexandria, Virginia, USA [doi>10.1145/1180405.1180414]
• 10: http://www.tpc.org/tpcc/. TPC-C Benchmark.
• 11: Sin Yeung Lee , Wai Lup Low , Pei Yuen Wong, Learning Fingerprints for a Database Intrusion Detection System, Proceedings of the 7th European Symposium on Research in Computer Security, p.264-280, October 14-16, 2002
• 12: Jun-Lin Lin , Margaret H. Dunham, A Survey of Distributed Database Checkpointing, Distributed and Parallel Databases, v.5 n.3, p.289-319, July 1997 [doi>10.1023/A:1008689312900]
• 13: Peng Liu, Architectures for Intrusion Tolerant Database Systems, Proceedings of the 18th Annual Computer Security Applications Conference, p.311, December 09-13, 2002
• 14: Peng Liu , Paul Ammann , Sushil Jajodia, Rewriting Histories: Recovering from Malicious Transactions, Distributed and Parallel Databases, v.8 n.1, p.7-40, Jan. 2000 [doi>10.1023/A:1008731200105]
• 15: David Lomet , Zografoula Vagena , Roger Barga, Recovery from "bad" user transactions, Proceedings of the 2006 ACM SIGMOD international conference on Management of data, June 27-29, 2006, Chicago, IL, USA [doi>10.1145/1142473.1142512]
• 16: J. McDermott , D. Goldschlag, Towards a model of storage jamming, Proceedings of the 9th IEEE workshop on Computer Security Foundations, p.176, March 10-12, 1996
• 17: C. Mohan , Don Haderle , Bruce Lindsay , Hamid Pirahesh , Peter Schwarz, ARIES: a transaction recovery method supporting fine-granularity locking and partial rollbacks using write-ahead logging, ACM Transactions on Database Systems (TODS), v.17 n.1, p.94-162, March 1992 [doi>10.1145/128765.128770]
• 18: OWASP. Owasp top ten most critical web application security vulnerabilities. http://www.owasp.org/documentation/topten.html, January, 27 2004.
• 19: Brajendra Panda , Joseph Giordano, Reconstructing the Database after Electronic Attacks, Proceedings of the IFIP TC11 WG 11.3 Twelfth International Working Conference on Database Security XII: Status and Prospects, p.143-156, July 15-17, 1998
• 20: Roberto Perdisci , Guofei Gu , Wenke Lee, Using an Ensemble of One-Class SVM Classifiers to Harden Payload-based Anomaly Detection Systems, Proceedings of the Sixth International Conference on Data Mining, p.488-498, December 18-22, 2006 [doi>10.1109/ICDM.2006.165]
• 21: Postgresql. http://www.postgresql.org/.
• 22: Rumman Sobhan , Brajendra Panda, Reorganization of the database log for information warfare data recovery, Proceedings of the fifteenth annual working conference on Database and application security, p.121-134, July 15-18, 2001, Niagara, Ontario, Canada
• 23: F. Valeur, D. Mutz, and G. Vigna. A learning-based approach to the detection of sql attacks. In Conference on Detection of Intrusions and Malware Vulnerability Assessment (DIMVA), pages 123--140, 2005.