Insider Threat Detection

Students: Oliver Kennedy

One of the greatest threats to a the security of a database system comes from within: Users who have been granted access to data using it in a malicious or illegitimate way. Often this is simply a matter of practicality; It is rarely feasible to establish an access control policy that is sufficiently permissive to be usable, while still being sufficiently restrictive to preclude malicious use. Our goal is to develop new types of statistical signatures for a user or role's behavior as they access a database. Using these signatures, we can identify non-standard behvaior that could be evidence of malicious activity.

(Insider Threats is supported by NSF Grant #69110 and is in collaboration with Shambhu Upadhyaya, Varun Chandola, and Long Nguyen)

Publications

Query Log Compression for Workload Analytics

Ting Xie, Varun Chandola, Oliver Kennedy

pVLDB 2019 [ paper | bibtex ]

@article{xie:2019:pvldb:query,
   author = {Xie, Ting and Chandola, Varun and Kennedy, Oliver},
   title = {Query Log Compression for Workload Analytics},
   journal = {pVLDB},
   year = {2019}
}

Similarity Metrics for SQL Query Clustering

Gökhan Kul, Duc Thanh Luong, Ting Xie, Varun Chandola, Oliver Kennedy, Shambhu Upadhyaya

TKDE 2018 [ preprint | article | bibtex ]

@article{kul:2018:tkde:similarity,
   author = {Kul, Gökhan and Luong, Duc Thanh and Xie, Ting and Chandola, Varun and Kennedy, Oliver and Upadhyaya, Shambhu},
   title = {Similarity Metrics for SQL Query Clustering},
   journal = {TKDE},
   volume = {30},
   year = {2018},
   month = {12},
   pages = {2408--2420}
}

SchemaDrill: Interactive Semi-Structured Schema Design

William Spoth, Ting Xie, Oliver Kennedy, Ying Yang, Beda Hammerschmidt, Zhen Hua Liu, Dieter Gawlick

HILDA 2018 (Workshop) [ paper | bibtex ]

@inproceedings{spoth:2018:hilda:schemadrill,
   author = {Spoth, William and Xie, Ting and Kennedy, Oliver and Yang, Ying and Hammerschmidt, Beda and Liu, Zhen Hua and Gawlick, Dieter},
   title = {SchemaDrill: Interactive Semi-Structured Schema Design},
   booktitle = {HILDA},
   year = {2018}
}

Summarizing Large Query Logs in Ettu

Gökhan Kul, Duc Thanh Luong, Ting Xie, Patrick Coonan, Varun Chandola, Oliver Kennedy, Shambhu Upadhyaya

ArXiv 2016 (Tech Report) [ report | bibtex ]

@techreport{kul:2016:arxiv:summarizing,
   author = {Kul, Gökhan and Luong, Duc Thanh and Xie, Ting and Coonan, Patrick and Chandola, Varun and Kennedy, Oliver and Upadhyaya, Shambhu},
   title = {Summarizing Large Query Logs in Ettu},
   institution = {ArXiv},
   year = {2016}
}

Ettu: Analyzing Query Intents in Corporate Databases

Gökhan Kul, Duc Thanh Luong, Ting Xie, Patrick Coonan, Varun Chandola, Oliver Kennedy, Shambhu Upadhyaya

ERMIS 2016 (Workshop) [ paper | bibtex ]

@inproceedings{kul:2016:ermis:ettu,
   author = {Kul, Gökhan and Luong, Duc Thanh and Xie, Ting and Coonan, Patrick and Chandola, Varun and Kennedy, Oliver and Upadhyaya, Shambhu},
   title = {Ettu: Analyzing Query Intents in Corporate Databases},
   booktitle = {ERMIS},
   year = {2016}
}

A Preliminary Cyber Ontology for Insider Threats in the Financial Sector

Gökhan Kul, Shambhu Upadhyay

MIST 2015 (Workshop) [ paper | bibtex ]

@inproceedings{kul:2015:mist:preliminary,
   author = {Kul, Gökhan and Upadhyay, Shambhu},
   title = {A Preliminary Cyber Ontology for Insider Threats in the Financial Sector},
   booktitle = {MIST},
   year = {2015}
}

Datasets

• UB Exam Dataset (2016)