TC: Small: Analysis and Privacy Tools for Enterprise Database Audit Logs

审计日志记录是综合数据安全和隐私基础设施的基本组成部分。它是对其他访问控制和安全机制的补充，对于记录内部人员不适当的数据访问特别有用。最近的立法和监管要求各个领域的组织维护跟踪其数据使用的审计日志，商业数据库系统开始支持自动记录所有数据访问。该项目的第一个主要目标是开发工具，以支持对日志信息进行简单和主动的分析。该系统将利用声明性查询（例如SQL）和统计异常检测的优势。例如，使用新的框架，分析师将能够制作定制的探索性查询和可视化表示，而不是简单地根据预训练的配置文件或规则集将传入的查询标记为异常。为了支持这样一个工具，RPI的研究团队将设计并构建一个独立的子系统，称为Splash，它扩展了关系DBMS的功能，以合并对管理统计模型的支持。尽管以安全和问责制的名义收集审计日志，但在某些情况下，日志本身可能会对访问底层数据库的用户的隐私构成风险。该项目的第二个主要目标是开发用于管理与收集和存储审计日志相关的隐私风险的工具。学生将参与整个研究项目。该软件将通过开源软件进行分发。

Audit logging is a fundamental component of a comprehensive data security and privacy infrastructure. It is complementary to other access control and security mechanisms, and is particularly useful for recording inappropriate data access by insiders. Recent legislation and regulatory oversight require organizations in a variety of domains to maintain audit logs tracking their use of data, and commercial database systems are beginning to provide support for automatically recording all data accesses.The first main goal of this project is to develop tools to support easy and proactive analysis of logged information. The system will leverage the strengths of both declarative queries (e.g., SQL) and statistical anomaly detection. Using the new framework, for example, rather than simply flagging incoming queries as anomalous based on a pre-trained set of profiles or rules, an analyst will be able to craft custom exploratory queries and visual representations. In support of such a tool, the research team at RPI will design and build an independent subsystem, called Splash, which extends the functionality of a relational DBMS to incorporate support for managing statistical models.Though audit logs are collected in the name of security and accountability, in certain situations the logs themselves may pose a risk to the privacy of users who access an underlying database. The second main goal of this project is to develop tools for managing the privacy risks associated with collecting and storing audit logs. Students will be engaged throughout the research program. The software will be distributed through open source software.