A Study on Database Intrusion Detection Based on Query Execution Plans

Database Intrusion Detection (DID) is critical to systems that do not fully apply the Principle of Least Privilege and users are able to use their privileges to compromise data privacy. Existing DID tools focus on analyzing SQL texts and they miss the cases of query equivalence and do not reveal data sources hidden behind views, synonyms, aliases. We propose to use Query Execution Plans (QEPs) to detect misuse queries and we describe a QEP-based DID System.