Detecting intrusion via insider attack in database transactions by learning disentangled representation with deep metric neural network

Gwang Myong Go; Seok Jun Bu; Sung Bae Cho

doi:10.1007/978-3-030-57805-3_43

Detecting intrusion via insider attack in database transactions by learning disentangled representation with deep metric neural network

Gwang Myong Go, Seok Jun Bu, Sung Bae Cho

College of Computing

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

1 Citation (Scopus)

Abstract

Database management systems based on role-based access control are widely used for information storage and analysis, but they are reportedly vulnerable to insider attacks. From the point of adaptive system, it is possible to perform classification on user queries accessing the database to determine insider attacks when they differ from the predicted values. In order to cope with high similarity of user queries, this paper proposes a deep metric neural network with hierarchical structure that extracts the salient features appropriately and learns the quantitative scale of similarity directly. The proposed model trained with 11,000 queries for 11 roles from the benchmark dataset of TPC-E produces the classification accuracy of 94.17%, which is the highest compared to the previous studies. The quantitative performance is evaluated by 10-fold cross-validation, the feature space embedded in the neural network is visualized by t-SNE, and the qualitative analysis is conducted by clustering the compression vectors among classes.

Original language	English
Title of host publication	13th International Conference on Computational Intelligence in Security for Information Systems, CISIS 2020
Editors	Álvaro Herrero, Carlos Cambra, Daniel Urda, Javier Sedano, Héctor Quintián, Emilio Corchado
Publisher	Springer Science and Business Media Deutschland GmbH
Pages	460-469
Number of pages	10
ISBN (Print)	9783030578046
DOIs	https://doi.org/10.1007/978-3-030-57805-3_43
Publication status	Published - 2021
Event	13th International Conference on Computational Intelligence in Security for Information Systems, CISIS 2020 - Burgos, Spain Duration: 2020 Sept 16 → 2020 Sept 18

Publication series

Name	Advances in Intelligent Systems and Computing
Volume	1267 AISC
ISSN (Print)	2194-5357
ISSN (Electronic)	2194-5365

Conference

Conference	13th International Conference on Computational Intelligence in Security for Information Systems, CISIS 2020
Country/Territory	Spain
City	Burgos
Period	20/9/16 → 20/9/18

Bibliographical note

Funding Information:
This research was supported by Samsung Electronics Co., Ltd.

Publisher Copyright:
© The Editor(s) (if applicable) and The Author(s), under exclusive license to Springer Nature Switzerland AG 2021.

All Science Journal Classification (ASJC) codes

Control and Systems Engineering
Computer Science(all)

Access to Document

10.1007/978-3-030-57805-3_43

Cite this

Go, G. M., Bu, S. J., & Cho, S. B. (2021). Detecting intrusion via insider attack in database transactions by learning disentangled representation with deep metric neural network. In Á. Herrero, C. Cambra, D. Urda, J. Sedano, H. Quintián, & E. Corchado (Eds.), 13th International Conference on Computational Intelligence in Security for Information Systems, CISIS 2020 (pp. 460-469). (Advances in Intelligent Systems and Computing; Vol. 1267 AISC). Springer Science and Business Media Deutschland GmbH. https://doi.org/10.1007/978-3-030-57805-3_43

Go, Gwang Myong ; Bu, Seok Jun ; Cho, Sung Bae. / Detecting intrusion via insider attack in database transactions by learning disentangled representation with deep metric neural network. 13th International Conference on Computational Intelligence in Security for Information Systems, CISIS 2020. editor / Álvaro Herrero ; Carlos Cambra ; Daniel Urda ; Javier Sedano ; Héctor Quintián ; Emilio Corchado. Springer Science and Business Media Deutschland GmbH, 2021. pp. 460-469 (Advances in Intelligent Systems and Computing).

@inproceedings{ab19b35bb2234e7d82954537b86cc088,

title = "Detecting intrusion via insider attack in database transactions by learning disentangled representation with deep metric neural network",

abstract = "Database management systems based on role-based access control are widely used for information storage and analysis, but they are reportedly vulnerable to insider attacks. From the point of adaptive system, it is possible to perform classification on user queries accessing the database to determine insider attacks when they differ from the predicted values. In order to cope with high similarity of user queries, this paper proposes a deep metric neural network with hierarchical structure that extracts the salient features appropriately and learns the quantitative scale of similarity directly. The proposed model trained with 11,000 queries for 11 roles from the benchmark dataset of TPC-E produces the classification accuracy of 94.17%, which is the highest compared to the previous studies. The quantitative performance is evaluated by 10-fold cross-validation, the feature space embedded in the neural network is visualized by t-SNE, and the qualitative analysis is conducted by clustering the compression vectors among classes.",

author = "Go, {Gwang Myong} and Bu, {Seok Jun} and Cho, {Sung Bae}",

note = "Funding Information: This research was supported by Samsung Electronics Co., Ltd. Publisher Copyright: {\textcopyright} The Editor(s) (if applicable) and The Author(s), under exclusive license to Springer Nature Switzerland AG 2021.; 13th International Conference on Computational Intelligence in Security for Information Systems, CISIS 2020 ; Conference date: 16-09-2020 Through 18-09-2020",

year = "2021",

doi = "10.1007/978-3-030-57805-3_43",

language = "English",

isbn = "9783030578046",

series = "Advances in Intelligent Systems and Computing",

publisher = "Springer Science and Business Media Deutschland GmbH",

pages = "460--469",

editor = "{\'A}lvaro Herrero and Carlos Cambra and Daniel Urda and Javier Sedano and H{\'e}ctor Quinti{\'a}n and Emilio Corchado",

booktitle = "13th International Conference on Computational Intelligence in Security for Information Systems, CISIS 2020",

address = "Germany",

}

Go, GM, Bu, SJ & Cho, SB 2021, Detecting intrusion via insider attack in database transactions by learning disentangled representation with deep metric neural network. in Á Herrero, C Cambra, D Urda, J Sedano, H Quintián & E Corchado (eds), 13th International Conference on Computational Intelligence in Security for Information Systems, CISIS 2020. Advances in Intelligent Systems and Computing, vol. 1267 AISC, Springer Science and Business Media Deutschland GmbH, pp. 460-469, 13th International Conference on Computational Intelligence in Security for Information Systems, CISIS 2020, Burgos, Spain, 20/9/16. https://doi.org/10.1007/978-3-030-57805-3_43

Detecting intrusion via insider attack in database transactions by learning disentangled representation with deep metric neural network. / Go, Gwang Myong; Bu, Seok Jun; Cho, Sung Bae.
13th International Conference on Computational Intelligence in Security for Information Systems, CISIS 2020. ed. / Álvaro Herrero; Carlos Cambra; Daniel Urda; Javier Sedano; Héctor Quintián; Emilio Corchado. Springer Science and Business Media Deutschland GmbH, 2021. p. 460-469 (Advances in Intelligent Systems and Computing; Vol. 1267 AISC).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

TY - GEN

T1 - Detecting intrusion via insider attack in database transactions by learning disentangled representation with deep metric neural network

AU - Go, Gwang Myong

AU - Bu, Seok Jun

AU - Cho, Sung Bae

N1 - Funding Information: This research was supported by Samsung Electronics Co., Ltd. Publisher Copyright: © The Editor(s) (if applicable) and The Author(s), under exclusive license to Springer Nature Switzerland AG 2021.

PY - 2021

Y1 - 2021

N2 - Database management systems based on role-based access control are widely used for information storage and analysis, but they are reportedly vulnerable to insider attacks. From the point of adaptive system, it is possible to perform classification on user queries accessing the database to determine insider attacks when they differ from the predicted values. In order to cope with high similarity of user queries, this paper proposes a deep metric neural network with hierarchical structure that extracts the salient features appropriately and learns the quantitative scale of similarity directly. The proposed model trained with 11,000 queries for 11 roles from the benchmark dataset of TPC-E produces the classification accuracy of 94.17%, which is the highest compared to the previous studies. The quantitative performance is evaluated by 10-fold cross-validation, the feature space embedded in the neural network is visualized by t-SNE, and the qualitative analysis is conducted by clustering the compression vectors among classes.

AB - Database management systems based on role-based access control are widely used for information storage and analysis, but they are reportedly vulnerable to insider attacks. From the point of adaptive system, it is possible to perform classification on user queries accessing the database to determine insider attacks when they differ from the predicted values. In order to cope with high similarity of user queries, this paper proposes a deep metric neural network with hierarchical structure that extracts the salient features appropriately and learns the quantitative scale of similarity directly. The proposed model trained with 11,000 queries for 11 roles from the benchmark dataset of TPC-E produces the classification accuracy of 94.17%, which is the highest compared to the previous studies. The quantitative performance is evaluated by 10-fold cross-validation, the feature space embedded in the neural network is visualized by t-SNE, and the qualitative analysis is conducted by clustering the compression vectors among classes.

UR - http://www.scopus.com/inward/record.url?scp=85091148757&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=85091148757&partnerID=8YFLogxK

U2 - 10.1007/978-3-030-57805-3_43

DO - 10.1007/978-3-030-57805-3_43

M3 - Conference contribution

AN - SCOPUS:85091148757

SN - 9783030578046

T3 - Advances in Intelligent Systems and Computing

SP - 460

EP - 469

BT - 13th International Conference on Computational Intelligence in Security for Information Systems, CISIS 2020

A2 - Herrero, Álvaro

A2 - Cambra, Carlos

A2 - Urda, Daniel

A2 - Sedano, Javier

A2 - Quintián, Héctor

A2 - Corchado, Emilio

PB - Springer Science and Business Media Deutschland GmbH

T2 - 13th International Conference on Computational Intelligence in Security for Information Systems, CISIS 2020

Y2 - 16 September 2020 through 18 September 2020

ER -

Go GM, Bu SJ, Cho SB. Detecting intrusion via insider attack in database transactions by learning disentangled representation with deep metric neural network. In Herrero Á, Cambra C, Urda D, Sedano J, Quintián H, Corchado E, editors, 13th International Conference on Computational Intelligence in Security for Information Systems, CISIS 2020. Springer Science and Business Media Deutschland GmbH. 2021. p. 460-469. (Advances in Intelligent Systems and Computing). doi: 10.1007/978-3-030-57805-3_43

Detecting intrusion via insider attack in database transactions by learning disentangled representation with deep metric neural network

Abstract

Publication series

Conference

Bibliographical note

All Science Journal Classification (ASJC) codes

Access to Document

Other files and links

Fingerprint

Cite this