Detecting Advanced Persistent Threats in Oracle Databases

Abstract

Advanced persistent threats (APTs) have become a big problem for computer systems. Databases are vulnerable to these threats and can give attackers access to an organizations sensitive data. Oracle databases are at greater risk due to their heavy use as back-ends to corporate applications such as enterprise resource planning software. This chapter will describe a methodology for finding APTs hiding or operating deep within an Oracle database system. Using an understanding of Oracle normal operations provides a baseline to assist in discovering APT behavior. Incorporating these and other techniques such as database activity monitoring, machine learning, neural networks and honeypots/tokens can create a database intrusion detection system capable of finding these threats.