提出了一种基于OCAR挖掘的数据库异常检测模型,通过对含有WHERE条件的SQL语句唯一确定的完全条件表达式进行特征提取和形式化分析,挖掘表征用户正常行为模式的目标一条件关联规则集(OCARS),并利用OCARS进行数据库异常检测,给出了针对OCARS的挖掘算法和异常检测算法,并给出针对事务异常检测扩展方案。最后,通过SQL注入检测实验对模型的性能和应用作了分析。
A database anomaly detection model based on mining object-condition association rules (OCAR) was proposed. Through analyzing and formalizing the only maximum conditional expression of SQL statements with WHERE clause, the object-condition association rule sets (OCARS) are mined, which represent normal user patterns. And the OCARS are used in anomaly detection. Additionally, OCARS mining algorithm and anomaly detection algorithm were given, and they could be easily used in anomaly transaction detection mechanism. In the end, the experiments about detecting SQL injection were given, and the performance and application were also analyzed.