TC: Small: Analysis and Privacy Tools for Enterprise Database Audit Logs

TC：小型：企业数据库审计日志的分析和隐私工具

• 批准号: 0915782
• 负责人: Hosagrahar Jagadish
• 金额: $ 50万
• 依托单位: Regents of the University of Michigan - Ann Arbor
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2009
• 资助国家: 美国
• 起止时间: 2009-08-01 至 2014-07-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0915782&HistoricalAwards=false
• 关键词: TC; Small; Analysis; Privacy; Tools

Audit logging is a fundamental component of a comprehensive data security and privacy infrastructure. It is complementary to other access control and security mechanisms, and is particularly useful for recording inappropriate data access by insiders. Recent legislation and regulatory oversight require organizations in a variety of domains to maintain audit logs tracking their use of data, and commercial database systems are beginning to provide support for automatically recording all data accesses.The first main goal of this project is to develop tools to support easy and proactive analysis of logged information. The system will leverage the strengths of both declarative queries (e.g., SQL) and statistical anomaly detection. Using the new framework, for example, rather than simply flagging incoming queries as anomalous based on a pre-trained set of profiles or rules, an analyst will be able to craft custom exploratory queries and visual representations. In support of such a tool, the research team at RPI will design and build an independent subsystem, called Splash, which extends the functionality of a relational DBMS to incorporate support for managing statistical models.Though audit logs are collected in the name of security and accountability, in certain situations the logs themselves may pose a risk to the privacy of users who access an underlying database. The second main goal of this project is to develop tools for managing the privacy risks associated with collecting and storing audit logs. Students will be engaged throughout the research program. The software will be distributed through open source software.

审核日志记录是综合数据安全和隐私基础设施的基本组成部分。 它是对其他访问控制和安全机制的补充，对于记录内部人员的不当数据访问特别有用。 最近的立法和监管监督要求各个领域的组织维护跟踪其数据使用情况的审计日志，商业数据库系统开始提供对自动记录所有数据访问的支持。该项目的第一个主要目标是开发工具来支持对记录信息进行轻松主动的分析。 该系统将利用声明性查询（例如 SQL）和统计异常检测的优势。例如，使用新框架，分析师将能够制作自定义的探索性查询和视觉表示，而不是简单地根据一组预先训练的配置文件或规则将传入查询标记为异常。 为了支持这样的工具，RPI 的研究团队将设计和构建一个名为 Splash 的独立子系统，该子系统扩展了关系 DBMS 的功能，以纳入对管理统计模型的支持。虽然审计日志是以安全和责任的名义收集的，但在某些情况下，日志本身可能会对访问底层数据库的用户的隐私构成风险。 该项目的第二个主要目标是开发用于管理与收集和存储审核日志相关的隐私风险的工具。 学生将参与整个研究计划。 该软件将通过开源软件分发。