TC: Small: Analysis and Privacy Tools for Enterprise Database Audit Logs

TC：小型：企业数据库审计日志的分析和隐私工具

• 批准号: 0915782
• 负责人: Hosagrahar Jagadish
• 金额: $ 50万
• 依托单位: Regents of the University of Michigan - Ann Arbor
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2009
• 资助国家: 美国
• 起止时间: 2009-08-01 至 2014-07-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0915782&HistoricalAwards=false
• 关键词: TC; Small; Analysis; Privacy; Tools

Audit logging is a fundamental component of a comprehensive data security and privacy infrastructure. It is complementary to other access control and security mechanisms, and is particularly useful for recording inappropriate data access by insiders. Recent legislation and regulatory oversight require organizations in a variety of domains to maintain audit logs tracking their use of data, and commercial database systems are beginning to provide support for automatically recording all data accesses.The first main goal of this project is to develop tools to support easy and proactive analysis of logged information. The system will leverage the strengths of both declarative queries (e.g., SQL) and statistical anomaly detection. Using the new framework, for example, rather than simply flagging incoming queries as anomalous based on a pre-trained set of profiles or rules, an analyst will be able to craft custom exploratory queries and visual representations. In support of such a tool, the research team at RPI will design and build an independent subsystem, called Splash, which extends the functionality of a relational DBMS to incorporate support for managing statistical models.Though audit logs are collected in the name of security and accountability, in certain situations the logs themselves may pose a risk to the privacy of users who access an underlying database. The second main goal of this project is to develop tools for managing the privacy risks associated with collecting and storing audit logs. Students will be engaged throughout the research program. The software will be distributed through open source software.

审计日志记录是全面的数据安全和隐私基础设施的基本组成部分。 它是对其他访问控制和安全机制的补充，对于记录内部人员的不当数据访问特别有用。 最近的立法和管理监督要求各领域的组织维护审计日志，跟踪其数据使用情况，商业数据库系统开始支持自动记录所有数据访问。本项目的第一个主要目标是开发工具，支持对记录信息进行简单和主动的分析。 系统将利用两个声明性查询的优势（例如，SQL）和统计异常检测。例如，使用新的框架，而不是简单地根据预先训练的配置文件或规则集将传入的查询标记为异常，分析师将能够制作自定义的探索性查询和视觉表示。 为了支持这样一个工具，RPI的研究团队将设计和构建一个独立的子系统，称为Splash，它扩展了关系数据库管理系统的功能，以支持管理统计模型。虽然审计日志是以安全和责任的名义收集的，但在某些情况下，日志本身可能会对访问底层数据库的用户的隐私构成风险。 该项目的第二个主要目标是开发用于管理与收集和存储审计日志相关的隐私风险的工具。 学生将参与整个研究计划。 该软件将通过开放源码软件分发。