Insider Threat in Database Systems: Preventing Malicious Users' Activities in Databases

Existing database misuse detection systems are not well equipped to identify malicious activities carried out by legitimate users of the system. In this paper we present a model that can prevent malicious insider activities at the database application level. Our model is based on user tasks, each of which maps to several transactions. An implementation-oriented approach is described to validate these tasks as they are executed by authenticated users. Using simulation analysis we demonstrate the effectiveness of our method.