Adaptive Database Intrusion Detection based on Michigan-style Deep Learning Classifier System

Seok-Jun Bu, Sung-Bae Cho

http://doi.org/10.5626/JOK.2023.50.10.891

In a role-based access control (RBAC) environment, database intrusion detection can be achieved by designing a role classifier for query transactions and determining it as an intrusion when the predicted role differs from the actually performed role. The current query-role classifier design methods utilize deep learning models, but it was difficult to simultaneously achieve high accuracy and incomplete adaptability for changing patterns. To solve this problem, this study proposes a Michigan-style Deep Learning Classifier System (MDLCS). This method applies a divide-and-conquer strategy that divides the input space into patterns and assigns an optimal classifier, combining the evolutionary computation principle of a Michigan-style learning classifier system with a deep learning classifier to adapt and improve detection performance for real-time changing patterns.The proposed MDLCS method provides strong adaptability and robustness compared to existing intrusion detection methods such as anomaly detection, signature-based detection and behavior-based detection. MDLCS was evaluated in a commercial database following the TPC-E schema and achieved a 26.81%p improved detection performance compared to existing methods under real environmental conditions in which new patterns sequentially emerge.