Insider Threat in Database Systems: Preventing Malicious Users´ Activities in Databases

Existing database misuse detection systems are not well equipped to identify malicious activities carried out by legitimate users of the system. In this paper we present a model that can prevent malicious insider activities at the database application level. Our model is based on user tasks, each of which maps to several transactions. An implementation-oriented approach is described to validate these tasks as they are executed by authenticated users. Using simulation analysis we demonstrate the effectiveness of our method.