A robust technique for relational database watermarking and verification

Data exfiltration

Abstract: ContextOne of the main targets of cyber-attacks is data exfiltration, which is the leakage of sensitive or private data to an unauthorized entity. Data exfiltration can be perpetrated by an outsider or an insider of an organization. Given the increasing number of data exfiltration incidents, a large number of data exfiltration countermeasures have been developed. These countermeasures aim to detect, prevent, or investigate exfiltration of sensitive or private data. With the growing interest in data exfiltration, it is important to review data exfiltration attack vectors and countermeasures to support future research in this field. ObjectiveThis paper is aimed at identifying and critically analysing data exfiltration attack vectors and countermeasures for reporting the status of the art and determining gaps for future research. MethodWe have followed a structured process for selecting 108 papers from seven publication databases. Thematic analysis method has been applied to analyse the extracted data from the reviewed papers. ResultsWe have developed a classification of (1) data exfiltration attack vectors used by external attackers and (2) the countermeasures in the face of external attacks. We have mapped the countermeasures to attack vectors. Furthermore, we have explored the applicability of various countermeasures for different states of data (i.e., in use, in transit, or at rest). ConclusionThis review has revealed that (a) most of the state of the art is focussed on preventive and detective countermeasures and significant research is required on developing investigative countermeasures that are equally important; (b) Several data exfiltration countermeasures are not able to respond in real-time, which specifies that research efforts need to be invested to enable them to respond in real-time (c) A number of data exfiltration countermeasures do not take privacy and ethical concerns into consideration, which may become an obstacle in their full adoption (d) Existing research is primarily focussed on protecting data in in use state, therefore, future research needs to be directed towards securing data in in rest and in transit states (e) There is no standard or framework for evaluation of data exfiltration countermeasures. We assert the need for developing such an evaluation framework.

A Survey of Data Distortion Watermarking Relational Databases

Abstract: Watermarking relation al database is a technique which can provide ownership protection and temper proofing for relational databases. Although it has been developed over ten years, it is still not popular. For attracting more people to study this technique, we introduce it in detail in this paper. The main contributions of this paper include: 1) To the best of our knowledge, this is the first paper which specially surveys data distortion watermarking relational databases; 2) We define a new requirement analysis t able for data distortion watermarking relational databases and use it to analyze important and t he newest research of data distortion watermarking relational databases; 3) We explain background knowledge of watermarking relational databases, such as types of attacks, requirements, and basic techniques.

Sub-curve HMM: A malware detection approach based on partial analysis of API call sequences

Abstract: Malicious software (Malware) plays an important role in penetrating and extracting sensitive information. Based on dynamic program’s behavior monitoring, existing solutions have shown that the Hidden Markov Model (HMM) is efficient in detecting malware using sequences of API calls. However, an obfuscation technique could insert minimal data stealing code into a large set of legitimate instructions, which makes the detector ineffective. Additionally, existing solutions require a whole picture of a program’s actions, and hence a small chunk of activities is much harder to detect. Substantial performance degradation can occur during the detection when a long sequence of APIs is used. This paper proposes the Sub-Curve HMM feature extraction approach that focuses on matching subsets of activities from the running processes that potentially lead to data exfiltration incidents. Sequences of API calls are used to train HMMs and test the likelihood of matching to the model. Malicious and benign activities gain different matching scores over an adjoining set of API calls. By projecting a sequence of matching score into a curve, our approach discriminates malicious actions using discontinuities in the slope of the curve. The experimental results show that the proposed approach outperforms existing solutions in detecting six (6) families of malware: the detection accuracy of Sub-Curve HMM is over 94% compared to 83% for the baseline HMM approach and 73% for Information Gain.

A Highly-Reliable Virtual Primary Key Scheme for Relational Database Watermarking Techniques

Abstract: Watermarking techniques for relational data have been proposed to allow copyright protection and data authenticity, among other things. Almost all proposals depend on the primary key of the database relations for deciding where and how to place the marks. The primary key could be easily updated or deleted if the attacker does not require watermarked data to be placed back in the database. The few techniques trying to avoid this dependency create a virtual primary key through schemes that frequently compute non-unique values, which may cause watermark synchronization problems. Also, the deletion of attributes compromises obtaining same values for the virtual primary key used for the mark embedding. In this paper, we propose a solution that solves the dependency of the primary key, avoiding the problem of non-unique values and showing more resilience against attribute deletion attacks than previous schemes.

HQR-Scheme: A High Quality and resilient virtual primary key generation approach for watermarking relational data

Abstract: Most of the watermarking techniques designed to protect relational data often use the Primary Key (PK) of relations to perform the watermark synchronization. Despite offering high confidence to the watermark detection, these approaches become useless if the PK can be erased or updated. A typical example is when an attacker wishes to use a stolen relation, unlinked to the rest of the database. In that case, the original values of the PK lose relevance, since they are not employed to check the referential integrity. Then, it is possible to erase or replace the PK, compromising the watermark detection with no need to perform the slightest modification on the rest of the data. To avoid the problems caused by the PK-dependency some schemes have been proposed to generate Virtual Primary Keys (VPK) used instead. Nevertheless, the quality of the watermark synchronized using VPKs is compromised due to the presence of duplicate values in the set of VPKs and the fragility of the VPK schemes against the elimination of attributes. In this paper, we introduce the metrics to allow precise measuring of the quality of the VPKs generated by any scheme without requiring to perform the watermark embedding. This way, time waste can be avoided in case of low-quality detection. We also analyze the main aspects to design the ideal VPK scheme, seeking the generation of high-quality VPK sets adding robustness to the process. Finally, a new scheme is presented along with the experiments carried out to validate and compare the results with the rest of the schemes proposed in the literature.

The Keyed-Hash Message Authentication Code (HMAC) | NIST

Abstract: This standard describes a keyed-hash message authentication code (HMAC), a mechanism for message authentication using cryptographic hash functions. HMAC can be used with any iterative FIPS-approved cryptographic hash function, in combination with a shared secret key. The cryptographic strength of HMAC depends on the properties of the underlying hash function. The HMAC specification in this standard is a generalization of Internet RFC 2104, HMAC, Keyed-Hashing for Message Authentication, and ANSI X9.71, Keyed Hash Message Authentication Code.

Watermarking relational databases

Abstract: We enunciate the need for watermarking database relations to deter their piracy, identify the unique characteristics of relational data which pose new challenges for watermarking, and provide desirable properties of a watermarking system for relational data. A watermark can be applied to any database relation having attributes which are such that changes in a few of their values do not affect the applications. We then present an effective watermarking technique geared for relational data. This technique ensures that some bit positions of some of the attributes of some of the tuples contain specific values. The tuples, attributes within a tuple, bit positions in an attribute, and specific bit values are all algorithmically determined under the control of a private key known only to the owner of the data. This bit pattern constitutes the watermark. Only if one has access to the private key can the watermark be detected with high probability. Detecting the watermark neither requires access to the original data nor the watermark. The watermark can be detected even in a small subset of a watermarked relation as long as the sample contains some of the marks. Our extensive analysis shows that the proposed technique is robust against various forms of malicious attacks and updates to the data. Using an implementation running on DB2, we also show that the performance of the algorithms allows for their use in real world applications.

Watermarking Relational Databases Using Optimization-Based Techniques

Abstract: Proving ownership rights on outsourced relational databases is a crucial issue in today's internet-based application environments and in many content distribution applications In this paper, we present a mechanism for proof of ownership based on the secure embedding of a robust imperceptible watermark in relational data We formulate the watermarking of relational databases as a constrained optimization problem and discuss efficient techniques to solve the optimization problem and to handle the constraints Our watermarking technique is resilient to watermark synchronization errors because it uses a partitioning approach that does not require marker tuples Our approach overcomes a major weakness in previously proposed watermarking techniques Watermark decoding is based on a threshold-based technique characterized by an optimal threshold that minimizes the probability of decoding errors We implemented a proof of concept implementation of our watermarking technique and showed by experimental results that our technique is resilient to tuple deletion, alteration, and insertion attacks