An Agent Based Approach to Perform Damage Assessment and Recovery Efficiently after a Cyber Attack to Ensure E-government Database Security

Databases that contain critical information become prime targets for attacks. E-Government sites often contain data that must remain available to its users with as little interruption as possible. In case an intrusion into such a system is detected, quick damage assessment and recovery of data is vital for maintaining system functionality. Conventional log based damage assessment methods require that the log of an affected database must be scanned from the occurrence of the attacking transaction to the end of the log. Hence, these methods result in slow recovery time since they have to unnecessarily process large volume of data, a lot of which may be unaffected by the attack. In this paper, we have provided a model that can expedite the damage assessment and recovery process by using minimal log access. Our approach uses multiple agents to perform damage assessment and recovery processes in parallel and, as a result, minimizes system down time.