28618164
Bootstrapping a data mining intrusion detection system
The application of data mining techniques in intrusion detection has received a lot of attention lately. Most of the approaches require of a training phase based on the availability of labelled data, where the labels indicate whether the points correspond to normal events or attacks. Unfortunately, this labelled data is not readily available in practice. In this paper we present a novel method based in intersecting segments of unlabelled data and using the intersection as the base data for unsupervised learning (clustering). The clustering algorithm, along with a method to find outliers with respect to the base clusters form the basis for separation of unlabelled data into groups of points that are normal (attack-free) and points that correspond to attacks. We show that the technique is very sucessful in separating points of the data sets of the DARPA, Lincoln Labs evaluation of 1999.
34010616
Referential Integrity in Multilevel Secure Database Management Systems
1492655
A new polyinstantiation integrity constraint for multilevel relations
A new polyinstantiation integrity constraint for multilevel relations based on the intuitive idea that every entity in a relation can have at most one tuple for every access class is proposed. The consequences of this property and some of its variations are discussed. A core set of properties which should apply to all relations is identified. These are entity integrity, interinstance integrity, subsumption integrity, and polyinstantiation integrity in the sense of PI-FD. Specific models impose additional polyinstantiation constraints. Oakland requires PI-null, Sea View requires PI-MVD, and the new Franconia model requires PI-Tuple-class. Each of these properties appears likely to arise often enough in practice to justify DBMS (database management system) support for its enforcement on a relation-by-relation basis.<<ETX>>
10201860
Policies, Models, and Languages for Access Control
Access control is the process of mediating every request to data and services maintained by a system and determining whether the request should be granted or denied. Expressiveness and flexibility are top requirements for an access control system together with, and usually in conflict with, simplicity and efficiency. In this paper, we discuss the main desiderata for access control systems and illustrate the main characteristics of access control solutions.
14529782
Data warehousing and data mining techniques for intrusion detection systems
This paper describes data mining and data warehousing techniques that can improve the performance and usability of Intrusion Detection Systems (IDS). Current IDS do not provide support for historical data analysis and data summarization. This paper presents techniques to model network traffic and alerts using a multi-dimensional data model and star schemas. This data model was used to perform network security analysis and detect denial of service attacks. Our data model can also be used to handle heterogeneous data sources (e.g. firewall logs, system calls, net-flow data) and enable up to two orders of magnitude faster query response times for analysts as compared to the current state of the art. We have used our techniques to implement a prototype system that is being successfully used at Army Research Labs. Our system has helped the security analyst in detecting intrusions and in historical data analysis for generating reports on trend analysis.
14701813
FlexFlow: A Flexible Flow Control Policy Specification Framework
We propose FlexFlow, a logic based flexible flow control framework to specify data-flow, work-flow and transaction systems policies that go beyond point-to-point flows. Both permissions and prohibitions are specifiable in FlexFlow and meta-policies such as permissions take precedence themselves can be specified over the meta-policy neutral policy specification environment of FlexFlow. We show the expressibility of FlexFlow by expressing three existing flow control models which were proposed for different applications and used different mechanisms.
1118243
Managing replicated files in partitioned distributed database systems
In this paper, we describe a consistency control algorithm for managing replicated files in the face of network partitioning due to node or communication link failures. It adopts a conservative approach in that mutual consistency among copies of a file is maintained by permitting files to be accessed only in a single partition. Our algorithm has the property that it permits dynamic switching between the “dynamic voting” algorithm and the “linearly ordered copies” algorithm. This aspect is not only appealing but results in greater file availability than in all previously published conservative algorithms.
13277150
Mutual consistency in decentralized distributed systems
In this paper we set forth a simple and efficient algorithm for managing replicated data in a decentralized distributed system, which allows for inserts, deletes, updates, and synonyms and which achieves a high degree of availability in the face of node or communication failures. We focus on the approach developed recently by Fischer and Michael and exploit the knowledge of the semantics of the database operations.
45839880
Universal and Representative Instances Using Unmarked Nulls
Representative instances are important since in addition to the universal relation view they permit updates in the individual relations; if these updates are locally valid, then they do not violate global consistency. In this paper, we first give conditions under which we can construct a universal instance I which uses only one type of nulls (unmarked nulls) and whose total projections onto the relation schemes yield exactly the database relations. Then, we give a necessary and sufficient condition under which this I is actually a representative instance. Our conditions are simple and easily maintained.
14539530
The Problem of Equivalence for Entity-Relationship Diagrams
We investigate the question of when two entity-relationship diagrams (ERD's) should be considered equivalent, in the sense of representing the same information. This question is very important for a database design process which uses the ERD model, and can be interpreted in various ways. We give three natural and increasingly stricter criteria for developing concepts of equivalence for ERD's. We first give a notion of "domain data compatibility" which ensures that the ERD's in question represent the same universe of data in an aggregate sense. Then we define the set of functional dependencies which are naturally embedded in each ERD, and use it to develop a concept of "data dependency equivalence" which ensures that the ERD's satisfy the same constraints (functional dependencies) among the represented data. Finally, we give our strongest criterion, instance data equivalence, which requires the ERD's to have the same power to represent instances of data. We develop several alternate forms of this third notion, including some giving efficient tableaux tests for its occurrence. Indeed, for each type of equivalence, we give a polynomial-time algorithm to test for it.
24298643
Translation of entity-relationship diagrams into relational structures
Abstract An entity-relationship diagram (ERD) is considered to have two conceptual domains: its upper and lower conceptual domains. The semantic properties intrinsic in the upper conceptual domain were studied recently by Lien. In this paper, we discuss the properties inherent in the lower conceptual domain. We show that the latter contains a significant portion of the semantic information of an ERD and helps determine its data representation power. We develop the notions of fundamental functional dependencies (FDs) which can be readily recognized for the lower conceptual domain of an ERD, and regular ERDs which are ERDs such that all the FDs present among their attributes can be derived from their fundamental FDs. Then we give conditions under which a large number of ERDs are equivalent to their underlying relational structures.