Damage Management in Database Management Systems

Abstract

In the past two decades there have been many advances in the field of computer security. However, since vulnerabilities cannot be completely removed from a system, successful attacks often occur and cause damage to the system. Despite numerous technological advances in both security software and hardware, there are many challenging problems that still limit effectiveness and practicality of existing security measures.

As Web applications gain popularity in today’s world, surviving Database Management System (DBMS) from an attack is becoming even more crucial than before because of the increasingly critical role that DBMS is playing in business/life/missioncritical applications. Although significant progress has been achieved to protect the DBMS, such as the existing database security techniques (e.g., access control, integrity constraint and failure recovery, etc.,), the buniness/life/mission-critical applications still

can be hit due to some new threats towards the back-end DBMS. For example, in addition to the vulnerabilities exploited by attacks (e.g., the SQL injections attack), databases can be damaged in several ways such as the fraudulent transactions (e.g., identity theft) launched by malicious outsiders, erroneous transactions issued by the insiders by mistakes. When the database is under such a circumstance (attack), rolling back and re-executing the damaged transactions are the most used mechanisms during the system recovery. This kind of mechanism either stops (or greatly restricts) the database service during repair, which causes unacceptable data availability loss or denialof-service for mission critical applications, or may cause serious damage spreading during

 

on-the-fly recovery where many clean data items are accidentally corrupted by legitimate new transactions. In this study, we address database damage management (DBDM), a very important problem faced today by a large number of mission/life/business-critical applications and information systems that must manage risk, business continuity, and assurance in the presence of severe cyber attacks.

Although a number of research projects have been done to tackle the emerging data corruption threats, existing mechanisms are still limited in meeting four highly desired requirements: near-zero-run-time overhead, zero-system-down time, zero-blockingtime for read-only transactions, minimal-delay-time for read-write transactions. Firstly, to achieve the four highly desired requirements, we propose TRACE, a zero-systemdown-time database damage tracking, quarantine, and recovery solution with negligible run time overhead. TRACE consists of a family of new database damage tracking, quarantine, and cleansing techniques. We built TRACE into the kernel of PostgreSQL. Secondly, motivated by the limitation of TRACE mechanism, we propose a novel proactive damage management approach denoted database firewalling. This approach deals with transaction level attacks. Pattern mining and Bayesian network techniques are adopted in the firewalling framework to mine frequent damage spreading patterns and to predict the data integrity in the face of attack when certain type of attack occurs repeatedly. This pattern mining and Bayesian inference approach provides a probability based strategy to estimate the data integrity on the fly. With this probabilistic feature, the database firewalling approach is able to enforce a policy of transaction filtering to dynamically filter out the potential damage spreading transactions.

 

Chapter 1 Introduction

Database Damage Management (DDM), especially the self-healing capability, is an important problem faced today by a great number of mission/life/business critical applications. As the Internet applications gain popularity and are embraced in industry to support today’s E-Business world, more and more threats towards the back-end database systems are identified. Surviving the back-end Database Management System (DBMS) from E-Crime is becoming even more crucial than before because of the increasingly critical role that the DBMS is playing and more critical and valuable information stored in databases which is now processed through the Web and is world wide accessible. A database system with the self-healing capability aims to assure these applications, such as banking, online stock trading, and air traffic control, etc., with high data integrity and service availability because these applications are the cornerstones of a variety of crucial information systems and infrastructures that must manage risk, business continuity, and data assurance in the presence of severe cyber-attacks. Although significant progress has been made in protecting such applications and systems, these mission/life/businesscritical applications still have a “good” chance to suffer from a big “hit” from attacks. Furthermore, due to data sharing, interdependencies, and interoperability between business processes and applications (e.g., the emerging web services), the hit could greatly magnify its damage by causing catastrophic cascading effects, which may “force” an application to shut down itself for hours or even days before the application is recovered from the hit. As we have seen that malicious attacks are difficult to prevent, self-healing capability is an indispensable part of the corresponding high assurance solution to satisfy the increasing demands on risk management, business continuity, and data assurance.

Conventional database management system (DBMS) failure recovery mechanisms are very mature in handling random failures, but have fundamental differences from attack self-healing. Existing failure recovery and the DBMS security techniques (e.g., authentication based access control, integrity constraints) are designed to guarantee the correctness, integrity, and availability of the stored data, but are very limited in dealing with data corruption. Moreover, failure recovery mechanisms do not defend the DBMS against some new threats that have come along with the rise of Internet, both from external source, e.g., SQL slammer worm [15] , SQL injection [55] , as well as from malicious insiders. As we will explain shortly in section 3.3, once a database server is attacked, the damage (data corruption) done by these attacks can have severe impact because not only is the data they write invalid (corrupted), but the data written by all other legitimate transactions that read these corrupted data may likewise become invalid. In this way, legitimate transactions can accidentally spread the damage to other innocent data.

In database security research, recent research concerns are the confidentiality, integrity, and availability of data stored in a database. Existing proposed research works primarily address how to protect the security of a database, especially its confidentiality, but seldom focus on how to survive successful database attacks, which can seriously impair the integrity and availability of a database. These existing DBMS security techniques are designed to guarantee the correctness, integrity, and availability of the stored data, but are very limited in dealing with data damage (corruption) and do not deal with the problem of malicious transactions. For example, access control can be subverted by the inside or outside attacker who has assumed an insider’s identity. Integrity constraints are weak at prohibiting plausible but incorrect data.

In addition, these insufficiently protected Web applications are not very difficult to break through [35] due to a well known reason that system vulnerabilities cannot be completely eliminated. For instance, online applications are often a combination of the following components: application servers, databases, and application specific code (e.g., server-side transaction procedures). Usually, on one hand, the back-bone software infrastructure (e.g., the web servers and database) is developed by experienced developers who have comprehensive knowledge of the security. On the other hand, the application oriented code is often developed under tight schedules by programmers who lack security training. Thus, such vulnerabilities can be exploited by skillful attackers with some efforts. One of the consequent results of such malicious exploits is the data corruption and integrity loss, a primary threat to the current data intensive applications. Experience with data-intensive applications has shown that a variety of attacks can successfully fool traditional protection mechanisms. In addition to the vulnerabilities exploited by attacks (e.g., the SQL injections attack), data corruption (data damage) can be caused in several ways such as the fraudulent transactions (e.g., identity theft) launched by malicious outsiders, erroneous transactions issued by the insiders by mistakes.

Applications mentioned above are mission/business-critical and are the cornerstones of a variety of crucial information systems, which play important role in many nation’s critical infrastructures, such as financial services,telecommunication infrastructure, and transportation control. Hence, one of the main challenges of current database security research is how to manage the data corruption (damage).

1.1       Problems in This Study

Damage management is a very important problem faced today by many mission, life, or business-critical applications and information systems that must manage risk, business continuity, and assurance in the presence of severe cyber attacks. Damage management is a broad research topic that spans over several perspectives. In this study, we investigate the critical damage management techniques in database security research from the following dimensions: damage spreading, damage quarantine and recovery, and damage management correctness and quality.

1.1.1             Light Weighted Damage Quarantine and Recovery System

Experience with data-intensive applications such as credit card billing, online banking, inventory tracking, and online stock trading, has shown that a variety of attacks successfully fool traditional database protection mechanisms. Due to data sharing and inter-operability between business process and applications, cyber attacks could even enhance their damage because of catastrophic cascading effects.

Techniques, such as flashback[53] implemented in Oracle database and [36] , can handle damaged data, but are costly to use and have serious impact on the compromised DBMSs. These techniques can seriously impair the database availability because not only the malicious transaction, but all the transactions committed after the malicious transaction are rolled back. Although a good number of research projects have been done to tackle the emerging data corruption threats, existing mechanisms are still quite limited in meeting four highly desired requirements: (R1)near-zero-run-time overhead, (R2) zero-system-down time, (R3) zero-blocking-time for read-only transactions, (R4) minimal-delay-time for read-write transactions. As a result, these proposed approaches introduce two apparent issues: 1) substantial run time overhead, 2) long system outage.

In this study, we propose TRACE, a zero-system-down-time database damage tracking, quarantine, and recovery solution with negligible run time overhead. The service outage is minimized by (a) cleaning up the compromised data on-the-fly, (b) using multiple versions to avoid blocking read-only transactions, and (c) doing damage assessment and damage cleansing concurrently to minimize delay time for read-write

transactions.

1.1.2           Preventive Damage Management Approach

As we will explain shortly in chapter 3.3 in details, once a DBMS is attacked, the damage (data corruption) done by these malicious transactions has severe impact on the DBMS because not only are the data they write invalid (corrupted), but the data written by all transactions that read these data may likewise be invalid. In this way, legitimate transactions can accidentally spread the damage to other innocent data. When a database system is attacked, the immediate negative effects (basically, the data damage) caused particularly by this attack are usually relatively limited. However, the negative effect can enlarge its impact largely because the data damage can be spread to other innocent data stored in the database system due to the nature of transactional read/write dependency of the database systems. we name it damage spreading. The database system armed with existing security technologies cannot continue providing satisfactory services because the integrity of some data objects is compromised. Simply identifying and repairing these compromised data objects by operating undo and redo transactions still cannot ensure the database integrity due to the damage spreading.

We propose to answer the following question: When a database system is identified under an attack by either an intrusion detection system (IDS) or a database administrator (DBA), how can the server prevent spread of damage while continuously providing data services? In this work, we take the first step to solve this problem. In particular, we propose a novel proactive damage management approach denoted database firewalling. This approach deals with transaction level attacks. We assume that these data corruption related attacks often leave a fingerprint in the system after attacks are launched, namely damage spreading pattern. The idea of this approach is to extract robust damage spreading pattern out of previous attack histories. When specific damage spreading patterns repeatedly appear under the same type of attacks, we can extract these patterns using some data mining techniques. Then, we can use these mined patterns to quickly predict the data objects that could have been corrupted during the intrusion detection latency window even before the time-consuming damage assessment procedure starts. Thereafter, we can set up firewalling rules to police data access requests from newly arrived transactions and block only the data objects that match the pre-mined patterns.

In this way, spread of damage can be dramatically reduced (if the patterns are good), while the great majority of data objects in the database will be continuously accessible during the entire online recovery process.

1.2       Contributions of This Work

In this work, we make the following contributions:

• we develop a light weight erroneous transaction tracing system, TRACE which captures the bad transactions caused by damage propagation, with a minimum amount of system outage.
• we develop a suite of tools to isolated the identified data records and repair them on-the-fly, and thus achieve the maximum system throughput during the time period of the system inconsistence.
• we propose TRACE-FG, a fine-grained zero-system-down-time database damage tracking, quarantine, and recovery solution with negligible run time overhead. TRACE-FG is able to decompose the “in-danger” unit and save the legitimated work.
• we apply our approach to open source PostgreSQL database, and find better performance than the current recovery approach applied in PostgreSQL database.
• we have demonstrated practical performance achievement and the feasibility of deployment of TRACE in the real database system.
• we propose a novel proactive damage management approach denoted database fire-

walling.

• we present an association rule based mining algorithm to discover the frequent damage spreading pattern. In addition, we provide an bayesian network based algorithm to dynamically estimate the data integrity using the discovered frequent spreading patterns.

1.3     Outline

The proposal is organized as follows. In Chapter 2, we present the main researches related to our studies. In Chapter 3, we propose TRACE, a zero-system-down-time database damage tracking, quarantine, and recovery solution with negligible run time overhead. In Chapter 4, we propose a novel mechanism, called database firewalling in this study to protect good data from being corrupted. In Chapter 5, we summarize the proposal, and overview the future works.

Chapter 3 is organized as follows. Section 3.3 describes some threats TRACE intends to handle and the problem statement. Section 3.4 overviews the key ideas of TRACE to identify and repair damaged data records on-the-fly. Section 3.5 introduces how we develop TRACE in PostgreSQL database system. Section 3.6 proposes a finegrained damage management system TRACE-FG. Section 3.7 demonstrates the experimental results of our TRACE system in comparison with current recovery mechanisms.

Chapter 4 is organized as follows. Some definitions used in this paper, the architecture of the database firewall, and an example of how damage spreads are presented in section 4.2. The framework of frequent spreading pattern mining is presented in section 4.4.2. The idea of predicting the integrity of data objects using Bayesian network are presented in section 4.5. Empirical studies are conducted in section 4.6.

Chapter 5 is organized as follows. Section 5.1 summarizes the dissertation. We mainly focus on investigating the critical security techniques in database damage management. Section 5.2.1 describes the future work. In the future work, we see that many opportunities for continued research in data damage management remain. We focus on developing from two perspectives that could improve our existing proposed approach.

Damage Management in Database Management Systems

Sharing is caring!