Detecting Advanced Persistent Threats in Oracle Databases: Methods and Techniques

Detecting Advanced Persistent Threats in Oracle Databases: Methods and Techniques

Lynn Ray (University of Maryland – University College, USA) and Henry Felch (University of Maine – Augusta, USA)
Copyright: © 2017 |Pages: 19
DOI: 10.4018/978-1-5225-1680-4.ch004

Abstract

Advanced persistent threats (APTs) have become a big problem for computer systems. Databases are vulnerable to these threats and can give attackers access to an organizations sensitive data. Oracle databases are at greater risk due to their heavy use as back-ends to corporate applications such as enterprise resource planning software. This chapter will describe a methodology for finding APTs hiding or operating deep within an Oracle database system. Using an understanding of Oracle normal operations provides a baseline to assist in discovering APT behavior. Incorporating these and other techniques such as database activity monitoring, machine learning, neural networks and honeypots/tokens can create a database intrusion detection system capable of finding these threats.
Chapter Preview
Top

Background

Before determining how to detect APTs, one needs to understand just what is an APT. Also the means of how they operate is important to determining how to detect them.

What Are They?

APTs are sophisticated cyber-attacks to get valuable information (Casenove & Kowalczewska, 2015). They use custom malware to gain leverage within a network. They may use a wide variety of tools and techniques to gain access to the target. They can vary their tools and techniques used depending on the target. The attackers are persistent and adjust their tactics to get around any protection mechanism in their way. They perform repetitive and continuous attacks over a long time. APT attacks use long-term campaigns and stealthy techniques (Chen, Desmet, & Huyens, 2014). Attackers use zero-day and and encryption to avoid detection. The attackers also consistently change their tactics as the defensive measures change (Kim, Cho, & Yeo, 2014). This makes them difficult to detect and stop. APTs can last for months to years depending on the attacker. It was believed that the skills needed to integrate an APT attack is too sophisticated for the average hacker. However, the tools available today require only basic skills to use and can be utilized to conduct an APT attack.

Complete Chapter List

Search this Book:
Reset