Monitoring cumulated anomaly in databases

Abstract

A new type of database anomaly called Cumulated Anomaly (CA) is dealt with in this paper. It occurs when submitting the time of authorized transactions or the changed data is cumulated out of some thresholds. A database-level detection method for Cumulated Anomaly is proposed based on statistics and fuzzy set theories. By measuring each database transaction with a real number between zero and one, this method quantitatively monitors how dangerous a transaction is. The real number is termed dubiety degree; therefore the method is named as Dubiety-Determining Method (DDM). After formally presenting the concepts of Cumulated Anomaly and DDM, the algorithm of DDM is given in detail. Software system architecture to support DDM was designed and implemented. Three experiments were performed on it for testing DDM. The first experiment showed the general results of DDM with a set of randomly generated audit records, while the second one simulated a practical case. DDM monitored dubiety degrees for each database transaction and detected expected Cumulated Anomaly in two experiments. The effect on database performance by DDM was tested in the last experiment. Experimental results show that DDM method is feasible and effective. © 2009 World Scientific Publishing Company.