CNN-LSTM neural networks for anomalous database intrusion detection in RBAC-administered model

Tae Young Kim, Sung Bae Cho

Research output: Chapter in Book/Report/Conference proceedingConference contribution

1 Citation (Scopus)

Abstract

The relational database is designed to store and process large amount of information such as business records and personal data. There are many policies and access control techniques for database security, but they are not sufficient for detecting insider attacks. In order to detect threats for the database application, it is necessary to adopt role-based access control (RBAC) and classify the roles according to the authority of each user. In this paper, we propose a method of classifying user’s role and authority using the CNN-LSTM neural networks by extracting features from SQL queries. In the anomaly detection method, CNN automatically extracts important features from database query and LSTM models the temporal information of the SQL sequence. The class activation map also identifies the SQL query features that affect the classification. Experiments with the TPC-E scenario-based benchmark query dataset show that the CNN-LSTM neural networks surpass other state-of-the-art machine learning methods, achieving an overall accuracy of 93.3% and recall of 88.7%. We also identify the characteristics of misclassification data through statistical analysis.

Original languageEnglish
Title of host publicationNeural Information Processing - 26th International Conference, ICONIP 2019, Proceedings
EditorsTom Gedeon, Kok Wai Wong, Minho Lee
PublisherSpringer
Pages131-139
Number of pages9
ISBN (Print)9783030368074
DOIs
Publication statusPublished - 2019
Event26th International Conference on Neural Information Processing, ICONIP 2019 - Sydney, Australia
Duration: 2019 Dec 122019 Dec 15

Publication series

NameCommunications in Computer and Information Science
Volume1142 CCIS
ISSN (Print)1865-0929
ISSN (Electronic)1865-0937

Conference

Conference26th International Conference on Neural Information Processing, ICONIP 2019
CountryAustralia
CitySydney
Period19/12/1219/12/15

All Science Journal Classification (ASJC) codes

  • Computer Science(all)
  • Mathematics(all)

Fingerprint Dive into the research topics of 'CNN-LSTM neural networks for anomalous database intrusion detection in RBAC-administered model'. Together they form a unique fingerprint.

  • Cite this

    Kim, T. Y., & Cho, S. B. (2019). CNN-LSTM neural networks for anomalous database intrusion detection in RBAC-administered model. In T. Gedeon, K. W. Wong, & M. Lee (Eds.), Neural Information Processing - 26th International Conference, ICONIP 2019, Proceedings (pp. 131-139). (Communications in Computer and Information Science; Vol. 1142 CCIS). Springer. https://doi.org/10.1007/978-3-030-36808-1_15