TC: Small: Analysis and Privacy Tools for Enterprise Database Audit Logs

TC：小型：企业数据库审计日志的分析和隐私工具

• 批准号: 0915782
• 负责人: Hosagrahar Jagadish
• 金额: $ 50万
• 依托单位: Regents of the University of Michigan - Ann Arbor
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2009
• 资助国家: 美国
• 起止时间: 2009-08-01 至 2014-07-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0915782&HistoricalAwards=false
• 关键词: TC; Small; Analysis; Privacy; Tools

Audit logging is a fundamental component of a comprehensive data security and privacy infrastructure. It is complementary to other access control and security mechanisms, and is particularly useful for recording inappropriate data access by insiders. Recent legislation and regulatory oversight require organizations in a variety of domains to maintain audit logs tracking their use of data, and commercial database systems are beginning to provide support for automatically recording all data accesses.The first main goal of this project is to develop tools to support easy and proactive analysis of logged information. The system will leverage the strengths of both declarative queries (e.g., SQL) and statistical anomaly detection. Using the new framework, for example, rather than simply flagging incoming queries as anomalous based on a pre-trained set of profiles or rules, an analyst will be able to craft custom exploratory queries and visual representations. In support of such a tool, the research team at RPI will design and build an independent subsystem, called Splash, which extends the functionality of a relational DBMS to incorporate support for managing statistical models.Though audit logs are collected in the name of security and accountability, in certain situations the logs themselves may pose a risk to the privacy of users who access an underlying database. The second main goal of this project is to develop tools for managing the privacy risks associated with collecting and storing audit logs. Students will be engaged throughout the research program. The software will be distributed through open source software.

审计日志记录是全面的数据安全和隐私基础设施的基本组成部分。它是对其他访问控制和安全机制的补充，对于记录内部人员不适当的数据访问特别有用。最近的立法和监管监督要求各个领域的组织维护跟踪其数据使用情况的审计日志，商业数据库系统开始支持自动记录所有数据访问。该项目的第一个主要目标是开发工具，支持对记录的信息进行轻松和主动的分析。该系统将利用声明性查询(例如，SQL)和统计异常检测两者的优势。例如，使用新的框架，分析师将能够定制探索性查询和可视化表示，而不是简单地根据预先训练的一组配置文件或规则将传入的查询标记为异常。为了支持这种工具，RPI的研究团队将设计和构建一个独立的子系统，称为Splash，它扩展了关系型DBMS的功能，纳入了对统计模型管理的支持。尽管审计日志是以安全和问责的名义收集的，但在某些情况下，日志本身可能会对访问底层数据库的用户的隐私构成风险。该项目的第二个主要目标是开发用于管理与收集和存储审计日志相关的隐私风险的工具。学生将在整个研究项目中参与进来。该软件将通过开源软件分发。